Curve is Ed25519

What this check verifies

This check reads every OKP key in the directory and confirms each one has crv set to Ed25519. An OKP key with a different curve, or none, raises a warning. Keys of other types (RSA, EC) are handled by the key type check and are not double-counted here.

For an OKP key, the crv member names the Edwards curve:

{ "kty": "OKP", "crv": "Ed25519", "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo", "kid": "..." }

Why a warning and not a failure: the directory draft permits any algorithm from the IANA HTTP Signature Algorithms registry. In practice every known Web Bot Auth deployment signs with Ed25519, and Ed25519 is the only algorithm this checker verifies today, so a different curve mostly costs interoperability. The warning states that.

A note on a related mistake: X25519 shares the OKP key type with Ed25519 but is a Diffie-Hellman key, not a signing key. Publishing it passes the key-type check and warns here, and no verifier will be able to check signatures against it.

Why it matters

The curve fixes the signature algorithm. A verifier built for the Ed25519 baseline reads crv to know it is dealing with an Ed25519 key; with another curve it has no key it can use, so your signatures go unverified by most of today’s infrastructure even when they are within the letter of the draft.

How to fix it

This is advisory; for maximum interoperability, set crv to Ed25519 on every OKP key:

{ "kty": "OKP", "crv": "Ed25519", "x": "...", "kid": "..." }

The common cause is generating the key on the wrong curve, or exporting a key meant for key exchange (X25519) instead of signing. Generate an Ed25519 keypair and export the public JWK, which will carry crv: "Ed25519". In a multi-key set, find the key with the wrong curve and replace it.

References

• RFC 8037 defines the OKP key type, the crv member, and Ed25519.
• RFC 7517 defines the JSON Web Key format.
• The web-bot-auth directory draft restricts alg to the IANA HTTP Signature Algorithms registry.
• How grading works explains how advisory warnings affect the score.