How to sign and verify Ed25519 signatures with OpenSSL

1# a new key pair: PKCS#8 private key and SPKI public key
2openssl genpkey -algorithm ed25519 -out ed25519.pem
3openssl pkey -in ed25519.pem -pubout -out ed25519.pub.pem

1# -rawin: Ed25519 signs the message itself, there is no separate digest step
2openssl pkeyutl -sign -inkey key.pem -rawin -in message.txt -out sig.bin
3od -An -v -tx1 sig.bin | tr -d ' \n'; echo   # 64 bytes, the same on every run

1openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in message.txt -sigfile sig.bin
2# "Signature Verified Successfully" (exit 0) or "Signature Verification Failure" (exit 1)

How it works

1. genpkey -algorithm ed25519 writes a PKCS#8 BEGIN PRIVATE KEY; pkey -pubout derives the SPKI BEGIN PUBLIC KEY from it.
2. pkeyutl -sign -rawin signs the file contents as they are. -rawin is required before OpenSSL 3.5 and implied from 3.5 on, so keeping it makes the command portable.
3. -pubin tells pkeyutl -verify that -inkey is a public key, and -sigfile names the signature. The exit code is 0 for a valid signature and 1 otherwise.
4. The run checks the generated key, prints the same signature as every other recipe of this task, and shows a one-character change in the message failing verification.

Gotchas

• Ed25519 refuses a digest: openssl dgst -sha256 -sign key.pem fails with Explicit digest not allowed with EdDSA operations. Without a digest, dgst -sign works on OpenSSL 3.5 but fails on 3.0 (Key type not supported for this operation); pkeyutl works on both.
• Piping the message in fails: printf … | openssl pkeyutl -sign -rawin … stops with unable to determine file size for oneshot operation. Ed25519 is one-shot, so OpenSSL needs a regular file via -in and reads all of it into memory.
• Without -pubin, pkeyutl reads -inkey as a private key, and a public key file fails with Could not find private key from pub.pem.
• The signature file holds 64 raw bytes — not DER, not base64. Encode it (base64, od) for systems that expect text, and decode it back before -sigfile.

Related recipes

• How to sign and verify Ed25519 signatures in Node.js
• How to sign and verify Ed25519 signatures in Python
• How to sign and verify Ed25519 signatures in Go
• How to sign a message with ECDSA with OpenSSL
• How to derive a shared key with ECDH and HKDF with OpenSSL