Ed25519 ZIP-215 verification: status in the 1.0.0 release candidate
Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.
This page replaces the 3.0.0-era “Ed25519-ZIP215 Security-Focused API Documentation”, which documented a security-hardened API at version 3.0.0 that no package of the 1.0.0-rc.7 line carries. The facts below are from the public API contract (documents/public-release/api-contract.md §12.1, a record, not an admission).
The verification rule every target implements
The catalog profile is ed25519 (mandatory, validated on all ten targets). Its exported verify implements RFC 8032 as written on every target (owner decision of 2026-09-24): decoding per §5.1.3, S < L compared in full, the cofactored equation [8][S]B = [8]R + [8][k]A, and no small-order screen, because RFC 8032 does not require one. Consequently a small-order public key verifies R = identity, S = 0 for every message; an application must not accept an arbitrary public key as an identity without its own proof of possession.
Where a target also has a ZIP-215 entry point, it implements ZIP-215: the same equation and S < L, with y reduced mod p and x = 0 with the sign bit accepted. The oracle for both rules is test-vectors/ed25519/ed25519-policy-vectors.json (37 cases, two independent generators agreeing on every verdict), and every target’s policy gate replays it.
| target | ZIP-215 entry point |
|---|---|
| Rust | metamui-ed25519-zip215 crate: verify, batch_verify_zip215 (in the Rust release line since 1.0.0-rc.7) |
| WASM | metamui-crypto-wasm/ed25519-zip215 |
| C | ed25519_verify_zip215, metamui_ed25519_zip215_verify |
| Swift | Ed25519ZIP215.verify with VerifyConfig.zip215 |
| Go | VerifyZIP215, BatchVerifyZIP215 |
| Python | verify_zip215 |
| TypeScript | none of its own (the WASM ed25519-zip215 package) |
| Kotlin | Ed25519Zip215.verify |
| Java | none: Ed25519Zip215 is a deprecated alias of Ed25519 with no ZIP-215 mode |
| C# | Ed25519Zip215.Verify |
ZIP-215 verification is not a catalog profile: no validation, packaging or interoperability claim is made for it beyond the policy gate above. Signing derives the public key from the seed on every target.
What is not claimed
No constant-time or side-channel property (A48, unmeasured), no independent audit, no certification, no performance figure. The former page’s API listings and usage examples are withdrawn: none was executed against the candidate, and this page carries no code.