How to sign and verify Ed25519 signatures in Rust

1[dependencies]
2ed25519-dalek = { version = "=3.0.0", features = ["pkcs8", "pem"] }
3hex = "=0.4.3"

1use ed25519_dalek::pkcs8::{DecodePrivateKey, DecodePublicKey};
2use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
3 
4fn main() -> Result<(), Box<dyn std::error::Error>> {
5    // PKCS#8 "BEGIN PRIVATE KEY" and SPKI "BEGIN PUBLIC KEY"
6    let signing_key = SigningKey::from_pkcs8_pem(&std::fs::read_to_string("key.pem")?)?;
7    let verifying_key = VerifyingKey::from_public_key_pem(&std::fs::read_to_string("pub.pem")?)?;
8    let message = std::fs::read("message.txt")?;
9 
10    let signature: Signature = signing_key.sign(&message);
11    std::fs::write("sig.bin", signature.to_bytes())?;
12    println!("signature: {}", hex::encode(signature.to_bytes()));
13 
14    // verify_strict also rejects small-order keys and non-canonical signatures
15    let received = Signature::from_slice(&std::fs::read("sig.bin")?)?;
16    println!("valid: {}", verifying_key.verify_strict(&message, &received).is_ok());
17    println!("tampered message valid: {}", verifying_key.verify(b"hello ed25520", &received).is_ok());
18    Ok(())
19}

How it works

1. The pkcs8 feature brings the DecodePrivateKey and DecodePublicKey traits; pem adds the from_pkcs8_pem and from_public_key_pem constructors used here.
2. SigningKey::sign comes from the Signer trait and returns a Signature; to_bytes() gives the 64-byte encoding every other language uses.
3. Signature::from_slice parses received bytes and returns an error for a wrong length instead of panicking.
4. verify_strict also rejects weak (small-order) public keys and non-canonical signatures that plain verify accepts; prefer it unless you must accept everything other implementations accept.

Gotchas

• Many examples online target ed25519-dalek 1.x, whose Keypair, SecretKey and PublicKey types were renamed to SigningKey and VerifyingKey in 2.0; they no longer compile. Pin the version, as the =3.0.0 above does.
• SigningKey::from_bytes takes the 32-byte seed. A 64-byte libsodium-style secret key goes through SigningKey::from_keypair_bytes, which also checks that the second half is the matching public key (Mismatched Keypair detected otherwise).
• With only the pkcs8 feature, the build fails with no associated function or constant named from_pkcs8_pem found for struct SigningKey — an error that points at your code, not at Cargo.toml. The PEM constructors need the pem feature as well.
• Signatures from this crate are deterministic, so tests may compare bytes against a fixture — but the same test against a randomized implementation such as Apple CryptoKit must verify instead.

Related recipes

• How to sign and verify Ed25519 signatures in Go
• How to sign and verify Ed25519 signatures in Python
• How to derive a shared key with ECDH and HKDF in Rust
• How to convert a PEM public key to a JWK and back in Rust