Interesting! My summary: Ed25519/EdDSA signatures are fully deterministic and do not use randomness at all. So if you have a service which signs the same mess

Interesting! My summary: Ed25519/EdDSA signatures are fully deterministic and do not use randomness at all. So if you have a service which signs the same message with the same key, it will produces the same signature every time. But what if this service runs on the embedded device you can fully control? If you can temporarily decrease the supply voltage for a few microseconds at just the right moment, you will cause a "fault"-- some data will get corrupted, but then program will proceed to work as usual. If this happens during signature, it'll output the wrong result, which will not pass signature verification. Turns out those "faults" can be very bad for Ed-family signatures -- if someone observes a signature made without faults, and a signature made with a fault during second-to-last step, and they make a lucky guess, they can extract a private key! This needs low-level physical access, so it does not apply to "big computers" -- your SSH is safe. But if you have a hardware device which does Ed* signing, and you can get it to repeatedly sign the same data, then this technique can be used to extract a private key which is normally locked inside.