---
title: "Algorithms & Ed25519 — Passkeys for Laravel | Roundly"
description: "ES256 and RS256 out of the box, Ed25519 (EdDSA) as an opt-in with ext-sodium — and no unvetted algorithm is ever accepted."
url: https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/algorithms
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Passkeys for Laravel](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)

# Algorithms & Ed25519

algorithms lists the COSE algorithm IDs offered and accepted, in preference order. The relying party accepts exactly three:

| Case | COSE ID | Notes |
| --- | --- | --- |
| `ES256` | \-7 | ECDSA P-256 / SHA-256. On by default. |
| `RS256` | \-257 | RSASSA-PKCS1-v1\_5 / SHA-256. On by default. |
| `EdDSA` | \-8 | Ed25519. Requires ext-sodium; off by default. |

## Opting into Ed25519

Ed25519 verification is fully implemented; it is only off by default because it needs ext-sodium. Once that extension is installed on every host that verifies these credentials, add it to config/passkeys.php:

```php
use RoundlyConsulting\Crypto\Cose\CoseAlgorithm;

'algorithms' => [
    CoseAlgorithm::ES256->value,   // -7
    CoseAlgorithm::RS256->value,   // -257
    CoseAlgorithm::EdDSA->value,   // -8 (requires ext-sodium)
],
```

## No algorithm confusion

The CoseAlgorithm registry comes from crypto-for-laravel and is deliberately wider — it also carries ES384 and ES512. This relying party accepts only ES256, RS256 and EdDSA (PasskeyConfig::SUPPORTED\_ALGORITHMS); configuring any other identifier throws InvalidConfiguration at boot rather than offering an algorithm the ceremony has not been vetted against.

At sign-in, the verification algorithm is read from the stored credential’s own COSE key — never from the assertion — and the configured allow-list is enforced at registration.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)