Ed25519 Cryptography & Offline Verification

How Vyntech Licenses implements asymmetric elliptic curve cryptography (Ed25519) and AES-256-GCM envelope encryption to deliver tamper-proof software licenses for connected and air-gapped environments.

Why Ed25519 Elliptic Curve Signatures?

Traditional licensing systems often rely on RSA-2048/4096 or legacy symmetric license hashing algorithms. These legacy approaches suffer from large key sizes, slow verification times, and vulnerability to side-channel timing attacks.

Ultra-Compact Keys

32-byte public keys and 64-byte signatures that easily fit inside license files, QR codes, or environment variables.

Microsecond Verification

Verifies thousands of signatures per second with near-zero CPU footprint during software startup.

Side-Channel Immune

Constant-time operations eliminate timing attack vectors and padding oracle vulnerabilities.

The Signed License Certificate (`.vynlic`)

The .vynlic file is a self-contained, cryptographically signed JSON document. Clients inspect the payload for entitlement gates and verify the signature using your public key:

{
  "payload": {
    "license_key": "VYN-STUDIO-PRO-8F2B-9C1A-4X7D-2E9F",
    "tenant_id": "848248c8-1111-2222-3333-444455556666",
    "product_id": "e8d641ef-52ba-4ca5-98e3-ffab7e20b3df",
    "product_code": "vyn-studio-pro",
    "customer_name": "Acme Media Global",
    "license_type": "subscription",
    "issued_at": 1787216400,
    "expires_at": 1818752400,
    "entitlements": {
      "render_8k": true,
      "cloud_collaboration": true,
      "gpu_acceleration": "unlimited",
      "max_team_members": 25
    },
    "node_locking": {
      "max_activations": 5
    }
  },
  "signature": "z4NfB19p6u8YkI4q0w...",
  "algorithm": "Ed25519",
  "public_key": "MCowBQYDK2VwAyEAx5s2D4K9P1qR8yZvLm0Nw3AbCdEfGhIjKlMnOpQrStU="
}

Offline Verification Implementations

Copy-pasteable verification routines for your client SDKs and native applications:

Go Client Implementation

package main

import (
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"time"
)

type LicenseCert struct {
	Payload   Payload `json:"payload"`
	Signature string  `json:"signature"`
}

type Payload struct {
	LicenseKey   string                 `json:"license_key"`
	ExpiresAt    *int64                 `json:"expires_at"`
	Entitlements map[string]interface{} `json:"entitlements"`
}

func VerifyLicenseCertificate(certBytes []byte, trustedPubKeyB64 string) (*Payload, error) {
	var cert LicenseCert
	if err := json.Unmarshal(certBytes, &cert); err != nil {
		return nil, fmt.Errorf("invalid license format: %w", err)
	}

	pubKeyBytes, err := base64.StdEncoding.DecodeString(trustedPubKeyB64)
	if err != nil || len(pubKeyBytes) != ed25519.PublicKeySize {
		return nil, errors.New("invalid public key")
	}

	sigBytes, err := base64.StdEncoding.DecodeString(cert.Signature)
	if err != nil {
		return nil, errors.New("invalid signature encoding")
	}

	payloadBytes, _ := json.Marshal(cert.Payload)

	// 1. Cryptographic Signature Verification
	if !ed25519.Verify(ed25519.PublicKey(pubKeyBytes), payloadBytes, sigBytes) {
		return nil, errors.New("signature mismatch: license file has been tampered with")
	}

	// 2. Expiration Verification
	if cert.Payload.ExpiresAt != nil && time.Now().Unix() > *cert.Payload.ExpiresAt {
		return nil, fmt.Errorf("license expired on %s", time.Unix(*cert.Payload.ExpiresAt, 0))
	}

	return &cert.Payload, nil
}

TypeScript / Node.js Implementation

import * as crypto from 'crypto';

interface LicenseCert {
  payload: {
    license_key: string;
    expires_at?: number;
    entitlements: Record<string, any>;
  };
  signature: string;
}

export function verifyLicense(cert: LicenseCert, trustedPubKeyB64: string): boolean {
  const payloadBuffer = Buffer.from(JSON.stringify(cert.payload));
  const signatureBuffer = Buffer.from(cert.signature, 'base64');
  const pubKeyBuffer = Buffer.from(trustedPubKeyB64, 'base64');

  const keyObject = crypto.createPublicKey({
    key: pubKeyBuffer,
    format: 'der',
    type: 'spki',
  });

  const isValid = crypto.verify(null, payloadBuffer, keyObject, signatureBuffer);
  if (!isValid) return false;

  if (cert.payload.expires_at && Date.now() / 1000 > cert.payload.expires_at) {
    return false; // License has expired
  }

  return true;
}

Python 3 Implementation

import base64
import json
import time
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def verify_license_file(cert_json_str: str, public_key_b64: str) -> dict:
    cert = json.loads(cert_json_str)
    pub_bytes = base64.b64decode(public_key_b64)
    sig_bytes = base64.b64decode(cert["signature"])
    payload_bytes = json.dumps(cert["payload"], separators=(',', ':')).encode('utf-8')

    # Verify Ed25519 Signature
    public_key = Ed25519PublicKey.from_public_bytes(pub_bytes[-32:])
    public_key.verify(sig_bytes, payload_bytes)

    # Check Expiry
    expires_at = cert["payload"].get("expires_at")
    if expires_at and time.time() > expires_at:
        raise ValueError("License has expired")

    return cert["payload"]