Ed25519 attestation for IoT fleets: a practical guide
How clinics and agriculture co-ops sign binaries once and verify on 500+ devices without a CA. No cloud required.
Most fleets don't need a certificate authority, a cloud trust service, or per-device credentials for software updates. They need one thing: the device to know, cryptographically, that the binary it is about to run came from the team that claimed to ship it. Ed25519 gives you that in a clean, offline-friendly package, and it is a natural fit for the constrained gateways daedalus targets.
Why Ed25519 and not RSA
Ed25519 is a modern elliptic-curve signature scheme standardized in RFC 8032. Its signatures are 64 bytes, its public keys are 32 bytes, and it is dramatically faster than RSA-2048 for both signing and verification - commonly cited as up to 30x faster at signing. That matters on a low-power ARM gateway where the update path runs on the same CPU as the application itself.
The academic and industry consensus reflects the same trade-off. A NordSec 2021 case study - “Size, Speed, and Security: An Ed25519 Case Study” - describes Ed25519 as a state-of-the-art signature algorithm specifically for low-performance IoT devices, with significant performance benefits over ECDSA on NIST P-256. The curve has seen wide adoption across TLS, DNSSEC, OpenSSH, OpenPGP, and OpenBSD Signify, all of which are mainstream examples of the same verification primitive.
The fleet model: sign once, verify everywhere
The design that works on 500+ devices without a CA is refreshingly simple:
- One offline Ed25519 keypair is generated and guarded as the "Daedalus-Verified" signing key.
- Each binary is signed once at build time; the signature and public key ride along inside the .de header.
- Every device ships with the public key embedded at image time and verifies each payload before it executes.
Because verification is a pure local operation - one Ed25519 verify against a millisecond-scale on ARM, in the range of ~100 microseconds on x86-64 - there is no round trip to a cloud service. An offline clinic or a farm with intermittent connectivity can still deploy signed binaries with full tamper evidence.
What about key compromise and rotation?
No scheme removes the need to protect the signing key. What Ed25519 gives you is a cheap way to do the common case safely and a monotonic version counter to block rollback attacks once a newer key rotates in. For the fleets we work with, that trade-off is the right one: the risk model is a stolen USB drive of binaries, not a state-level adversary.
Why no cloud, no CA
An air-gapped co-op or an off-grid clinic generally cannot depend on reaching a re-signing service at the moment of an emergency patch. A pre-embedded public key means device-side verification never needs network access. That is the real advantage of Ed25519 attestation for edge - verifiability without connectivity.