Algorithms & Ed25519

algorithms lists the COSE algorithm IDs offered and accepted, in preference order. The relying party accepts exactly three:

Opting into Ed25519

Ed25519 verification is fully implemented; it is only off by default because it needs ext-sodium. Once that extension is installed on every host that verifies these credentials, add it to config/passkeys.php:

use RoundlyConsulting\Crypto\Cose\CoseAlgorithm;

'algorithms' => [
    CoseAlgorithm::ES256->value,   // -7
    CoseAlgorithm::RS256->value,   // -257
    CoseAlgorithm::EdDSA->value,   // -8 (requires ext-sodium)
],

No algorithm confusion

The CoseAlgorithm registry comes from crypto-for-laravel and is deliberately wider — it also carries ES384 and ES512. This relying party accepts only ES256, RS256 and EdDSA (PasskeyConfig::SUPPORTED_ALGORITHMS); configuring any other identifier throws InvalidConfiguration at boot rather than offering an algorithm the ceremony has not been vetted against.

At sign-in, the verification algorithm is read from the stored credential’s own COSE key — never from the assertion — and the configured allow-list is enforced at registration.