System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Ed25519 public-key signatures

Updated: September 18, 2026

Want to summarize with AI?

Explains Ed25519 public-key signature support in Cisco IOS XR certificate-based trust, covering source behavior, constraints, and operational details for certification authority interoperability.

A Ed25519 public-key signature is a cryptographic algorithm that

uses elliptic curve cryptography to provide enhanced security and faster performance compared to other signature algorithms
enables certificate-based trust and interoperability with certificate authorities in Cisco IOS XR deployments, and
allows integration with Cisco Crosswork Trust Insights through key generation and management on 64-bit platforms.

Ed25519 keys can be generated with an empty label or predefined labels, such as system-root-key and system-enroll-key . When an empty label is used, the system assigns a default label. Predefined labels facilitate integration with Cisco Crosswork Trust Insights.

Feature history

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Support for Ed25519 Public-Key Signature System	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only) This feature is supported on the Cisco 8712-MOD-M routers.
Support for Ed25519 Public-Key Signature System	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM 8212-48FH-M 8711-32FH-M
Support for Ed25519 Public-Key Signature System	Release 7.3.1	This feature allows you to generate and securely store crypto key pair for the Ed25519 public-key signature algorithm on Cisco IOS XR 64-bit platforms. This signature system provides fast signing, fast key generation, fool proof session keys, collision resilience, and small signatures. The feature also facilitates integration of Cisco IOS XR with Cisco Crosswork Trust Insights. Commands introduced for this feature are: crypto key generate ed25519 crypto key zeroize ed25519 show crypto key mypubkey ed25519 Commands modified for this feature are: ca-keypair keypair

Configure Ed25519 crypto keys

Generate and manage Ed25519 crypto keys on your device to support certificate authority interoperability and ensure cryptographic integrity.

Ed25519 crypto keys provide high-performance digital signature capability and are interoperable with certificate authority requirements. You can generate and delete these keys from XR EXEC or XR Config mode.

Before you begin

Review the related certificate authority prerequisites for your deployment.
Ensure you have access to XR EXEC or XR Config mode on your device.

Procedure

Generate an Ed25519 crypto key.
Example:
```
Router# crypto key generate ed25519
```
To generate the Ed25519 crypto key, use the crypto key generate ed25519 command in XR EXEC mode or XR Config mode.

To delete the Ed25519 crypto key with default label or any predefined label, use the crypto key zeroize ed25519 command in XR EXEC mode.

Note

From Cisco IOS XR Release 7.3.2 onwards, you can generate and delete key-pairs from XR Config mode, as well. For more details, see Public key-pairs.

Verify the configuration.

Example:

Router# show crypto key mypubkey  ed25519

Mon Nov 30 07:05:06.532 UTC
Key label: the_default
Type : ED25519
Size : 256
Created : 07:03:17 UTC Mon Nov 30 2020
Data :
FF0ED4E7 71531B3D 9ED72C48 3F79EC59 9EFECCC3 46A129B2 FAAA12DD EE9D0351

Use the show crypto key mypubkey ed25519 command to view all Ed25519 crypto keys generated on the system.

The Ed25519 crypto keys are successfully generated and verified. You now have cryptographic keys ready for certificate authority interoperability and cryptographic operations.

Configure Ed25519 Crosswork Trust Insights integration

Enable secure integration between Cisco IOS XR and Crosswork Trust Insights by configuring Ed25519-based trustpoint and certificate management.

Use this task when you need to establish trust between Cisco IOS XR and Crosswork Trust Insights using the Ed25519 signature algorithm for certificates. This capability ensures interoperability with certificate authority requirements.

Before you begin

Review certificate authority prerequisites and verify access to Cisco IOS XR device configuration.
Ensure you have permission to enroll and authenticate trustpoints.

Procedure

Configure the domain name on the device.

Example:

Router# configure
Router(config)# domain name domain1
Router(config)# crypto ca trustpoint system-trustpoint
Router(config-trustp)#keypair ed25519 system-enroll-key
Router(config-trustp)#ca-keypair ed25519 system-root-key
Router(config-trustp)# commit

Router# crypto ca authenticate system-trustpoint
Router# crypto ca enroll system-trustpoint

This section shows how to generate the system trustpoint, and the root and leaf certificates using the Ed25519 signature algorithm, as part of integrating Cisco IOS XR with Cisco Crosswork Trust Insights.

Create a crypto CA trustpoint using Ed25519 key pairs.

Example:

Router(config)# crypto ca trustpoint system-trustpoint
Router(config-trustp)#keypair ed25519 system-enroll-key
Router(config-trustp)#ca-keypair ed25519 system-root-key
Router(config-trustp)# commit

Router# crypto ca authenticate system-trustpoint
Router# crypto ca enroll system-trustpoint

Authenticate the trustpoint with the certificate authority.
Example:
```
Router# crypto ca authenticate system-trustpoint
```
Enroll the trustpoint with the certificate authority
Example:
```
Router# crypto ca enroll system-trustpoint
```

Review the running configuration.

Example:

config
domain name domain1
crypto ca trustpoint system-trustpoint
 keypair ed25519 system-enroll-key
 ca-keypair ed25519 system-root-key
!

The device is successfully integrated with Crosswork Trust Insights using Ed25519 trustpoint and certificate authority configuration. You will see matching configuration and command output confirming successful interoperability.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.