The private key is a seed (32 bytes for Ed25519, 57 for Ed448). Hashing it yields a secret scalar s and a prefix; signing computes the nonce r = H(prefix ‖ M), R = r·B, the challenge k = H(R ‖ A ‖ M) and S = (r + k·s) mod L, and the signature is R ‖ S (64 bytes for Ed25519, 114 for Ed448; RFC 8032 §5.1.6 and §5.2.6). The nonce is a function of the key and the message, so EdDSA needs no randomness when signing and cannot repeat a nonce for different messages.
PureEdDSA (Ed25519, Ed448) signs the message itself and reads it twice; HashEdDSA (Ed25519ph, Ed448ph) signs a SHA-512 or SHAKE256 digest instead; Ed25519ctx and Ed448 accept a context string of up to 255 bytes for domain separation. FIPS 186-5 §7 approves EdDSA and HashEdDSA (§7.8).
Verification is less uniform than signing. RFC 8032 §5.1.7 requires S to be below the group order L and allows either the cofactored equation [8][S]B = [8]R + [8][k]A' or the cofactorless one, and libraries differ on small-order points and non-canonical encodings. Consensus systems therefore pin one rule set, for example Zcash's ZIP 215.
Identifiers: X.509 OIDs 1.3.101.112 (Ed25519) and 1.3.101.113 (Ed448) from RFC 8410; JOSE alg values Ed25519 and Ed448 from RFC 9864, which deprecates the polymorphic EdDSA of RFC 8037; COSE −19 and −53 (and the older −8); TLS 1.3 ed25519 (0x0807) and ed448 (0x0808); SSH ssh-ed25519. NIST IR 8547 (draft) proposes disallowing EdDSA after 2035.