Generating/loading an Ed25519 (EdDSA) key

If you want to be able to easily generate Ed25519, RSA and ECDSA public/private keys from within your Python app, consider using Privex’s Python Helpers which includes a cryptography module designed to make symmetric / asymmetric encryption simple.

Installing Privex Helpers:

# For a minimal install with just the cryptography dependencies
# change [full] to [crypto] (though [full] only adds a few small dependencies)
pip3 install 'privex-helpers[full]'

You can load/generate an Ed25519 private/public key however you want, but we’re using Privex Helpers ‘s crypto module as an example (and showcase of our library).

The below code uses Privex Helpers to generate an Ed25519 keypair and output the private key to id_ed25519 and the public key to id_ed25519.pub.

If you don’t want to save the keys to a file, you can use ed_priv, ed_pub = KeyManager.generate_keypair('ed25519') instead.

from privex.helpers import KeyManager

ed_priv, ed_pub = KeyManager.output_keypair('id_ed25519', 'id_ed25519.pub', alg='ed25519')

# ed_priv example contents:
# b'-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIBy9N4xfv/9qOiKrxwRKeGfO5ab6lSukKHbuC5vaJ1Mg\n-----END PRIVATE KEY-----\n'
# ed_pub example contents:
# b'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4pK2dePGgctIAsh0H/tmUrLzx2Vc4Ltc8TN9nfuChG'

Using privex-pyjwt to encode/decode JWT tokens with EdDSA

Private keys must be in PEM format with PKCS8, while public keys can be in either PEM (PKCS8) format or OpenSSH format (ssh-ed25519 ........ user@host).

Simply use jwt.encode and jwt.decode as normal, pass in your Ed25519 private key for encoding, the private/public key for decoding, and set the algorithm to EdDSA.

import jwt

# Tokens can only encoded with an Ed25519 private key
token = jwt.encode({'hello': 'world'}, ed_priv, algorithm='EdDSA')

# resulting token: b'eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSJ9.eyJoZWxsbyI6IndvcmxkIn0.HEDJTw1jNaz82WuP3O1l5_i-eaaj3DBEKesPUsInSgKuvbav6XaLORERs7wPrmS14DN_WlzDUCn0LmVGl4VlCg'

# However, tokens can be decoded using EITHER the public key (PEM / OpenSSH) or the private key,
# as we can interpolate the public key from the private key
jwt.decode(token, ed_priv, algorithms=['EdDSA'])

# Output: {'hello': 'world'}