9

It seems that Firefox and Chrome both support x25519 keys, but they do not accept keys signed using Ed25519. Am I correct? If so, where can I find the official source of this information?

1
  • 1
    The question's title seems to be about accepting certificates that are signed with Ed25519. The body of the questions seems to be about accepting Ed25519 signatures of x25519 ECDH session keys, that is certificates for Ed25519 signature keys, a different thing.
    – fgrieu
    Apr 16, 2023 at 8:54

1 Answer 1

10

You are correct, currently neither Chrome nor Firefox support the EdDSA signature scheme (i.e. neither Ed25519 nor Ed448).

For Firefox, there is a Bugzilla ticket open regarding support for Ed25519 in NSS, the crypto library used by Firefox.

Chrome is currently trialing Ed25519 in the Web Cryptography API. See the associated issue for details. Still, this is not the same as support for Ed25519 in certificates/TLS handshakes. I was unable to find an offical ticket tracking Ed25519 support in TLS handshakes for Chrome/Chromium, but the source code indicates that this is definetly not supported.

As noted in the Bugzilla ticket, certificates with Ed25519 keys are currently forbidden by the Baseline Requirements. All public Certificate Authorities have to adhere to the Baseline Requirements, so this key type is likely rarely used in X.509 certificates, as it can only be used for non-public certificates.

X25519 on the other hand, a Diffie-Hellmann key exchange using Curve25519 is well supported in browsers. Firefox has supported X25519 since approximately 2016 (old bugzilla ticket tracking inclusion). Chrome has supported X25519 since Chrome 50 according to Chromestatus.

2
  • If I have Ed25519 public private keypair, is there a way to deterministically generate X25519 keys to sign an X509 certificate that would be accepted by modern browsers? Nov 6, 2023 at 16:47
  • X25519 is a Diffie-Hellman function. You cannot sign anything with it. Both X25519 and Ed25519 are based on Curve25519, but otherwise are distinct algorithms with different applications (one is a key exchange method, the other is a signature scheme). As above, currently none of the major browsers supports a signature scheme based on Curve25519 in TLS.
    – Nummer378
    Nov 7, 2023 at 23:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .