An HMAC proves authenticity only between parties who already share a secret. A signature needs none: the holder of a private key signs, anyone with the matching public key verifies. That asymmetry is what makes TLS, package signing and RS256/ES256 tokens possible — hand the public key to a thousand services and none gains the power to forge. Ed25519 is the sensible default for anything new.
import { generateKeyPairSync, sign, verify, X509Certificate } from 'node:crypto';
import { readFileSync } from 'node:fs';
const { publicKey, privateKey } = generateKeyPairSync('ed25519');
const msg = Buffer.from('release 2.4.0 sha256:9f2c...');
const sig = sign(null, msg, privateKey); // Ed25519 hashes internally: digest is null
console.log('sig :', sig.length, 'bytes |', privateKey.asymmetricKeyType);
console.log('verify:', verify(null, msg, publicKey, sig));
console.log('tamper:', verify(null, Buffer.from('release 2.4.1'), publicKey, sig));
const cert = new X509Certificate(readFileSync('cert.pem'));
console.log('subject :', cert.subject.replace(/\n/g, ', '));
console.log('alt names:', cert.subjectAltName, '|', cert.validTo);
console.log('host ok :', cert.checkHost('api.example.com'),
'| rogue:', cert.checkHost('evil.example.net'));sig : 64 bytes | ed25519 verify: true tamper: false subject : CN=api.example.com, O=Example Inc alt names: DNS:api.example.com, DNS:www.example.com | Sep 17 11:04:02 2027 GMT host ok : api.example.com | rogue: undefined
An Ed25519 public key is 32 bytes and its signature 64, against 384 bytes for one RSA-3072 signature. For RSA, always pass padding: constants.RSA_PKCS1_PSS_PADDING with a saltLength; PKCS#1 v1.5 has a worse record. Averaged over 200 calls here, Ed25519 signs in 0.05 ms and verifies in 0.11, P-256 in 0.03 and 0.07, and RSA-2048 signs in 0.53 but verifies in 0.02 — its public exponent is only 17 bits, while signing uses the full private exponent. Key generation took 30 ms for RSA-2048 and 620 ms for RSA-4096, against under 1 ms for either curve.
An X.509 certificate binds a key to names and has an authority sign that binding, which is what says whose key it is. The test file came from openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -days 365 -keyout key.pem -out cert.pem plus -addext "subjectAltName=DNS:api.example.com". That last flag is required: browsers ignore CN (HTTPS and TLS Certificates).