# Ed25519 support with pkcs11-tool
**URL:** https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850
**Category:** HSM
**Created:** [February 21, 2023, 3:36pm UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850 "2023-02-21T15:36:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sonkkeli](https://support.nitrokey.com/u/sonkkeli)
#### Post date: [February 21, 2023, 3:36pm UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850/1 "2023-02-21T15:36:18Z")
Hey,
Do you have plans to support signing data with ed25519 keys using the `pkcs11-tool`? This is something similar that Yubikeys have quite nicely documented [here](https://developers.yubico.com/yubico-piv-tool/YKCS11/Supported_applications/pkcs11tool.html), but they only support RSA and some ECC keys but not Ed25519 keys which is what we’d like to use for our use case. Is there a plan to support ed25519 keys anytime in the near future?
I know that for example SoftHSM2 which is an emulation software for security keys already [supports ed25519](https://github.com/opendnssec/SoftHSMv2/blob/35938595f83923504751b40535570342f706a634/src/lib/pkcs11/pkcs11.h#L889) when it’s compiled from the source with the configuration flags
> ./configure --with-openssl=/usr/lib/ssl --enable-eddsa=yes
Also the `pkcs11-tool` itself supports `--key-type EC:ed25519`, but only with such a security key in place that supports the Ed25519 algorithm.
The command which I’d like to use would be:
> pkcs11-tool --module /path/to/lib-hsm.so --login --login-type so --keypairgen --id 0 --key-type EC:ed25519 --usage-sign --allowed-mechanisms 0x1057
---
### Author:  [@saper](https://support.nitrokey.com/u/saper)
#### Post date: [February 22, 2023, 6:43pm UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850/2 "2023-02-22T18:43:35Z")
Hey, you might want to check the following out:
> [@Nitrokey HSM2 - support for ed25519](https://support.nitrokey.com/t/nitrokey-hsm2-support-for-ed25519/2484/2):
>
> The SmartCard-HSM relies on the CC-certified crypto library of the SmartMX2 security controller and that does not support ed25519. Unfortunately NXP has no plans to add support in that library, so we are unable to support that in our code either. There is also little demand from the markets for which this chip is produced (large scale card deployments like banking, government, health), so I’m not optimistic that the situation will change. Additionally, there is no real benefit of those curves …
---
### Author:  [@zapper](https://support.nitrokey.com/u/zapper)
#### Post date: [February 23, 2023, 3:38am UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850/3 "2023-02-23T03:38:48Z")
Is this the same problem for the nitrokey Storage version?
If it is, are there better alternatives out there that might be implemented, with less weaknesses?
Just wondering.
Or as many.
From what I recall, curve25519 is one of the better ones still. Though its unknown for how much longer this will be true.
At least I think it is true? The answers to the contrary haven’t sounded clear cut to me, but maybe?
meh…
---
### Author:  [@saper](https://support.nitrokey.com/u/saper)
#### Post date: [February 23, 2023, 9:02am UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850/4 "2023-02-23T09:02:52Z")
> [@zapper](#):
>
> Is this the same problem for the nitrokey Storage version?
The answer pertains only to Nitrokey HSM.
---
### Author:  [@zapper](https://support.nitrokey.com/u/zapper)
#### Post date: [April 19, 2023, 7:48pm UTC](https://support.nitrokey.com/t/ed25519-support-with-pkcs11-tool/4850/5 "2023-04-19T19:48:59Z")
So nitrokey storage doesn’t have this problem? Or is it like N/A in its entirety?