> ed25519 is more secure in practice. One of the biggest reasons to go with ed25519 is that it's immune to a lot of common side channels. While ed25519 is slightly less complex to crack in theory, in practice both of them are long enough that you're never going to be able to crack it, you need a flaw to exploit in the implementation or a substantial leap forward in cryptanalysis. ed25519 is more secure in practice because most instances of a break in any modern cryptosystem is a flaw in the implementation, ed25519 lowers the attack surface here.
https://www.reddit.com/r/sysadmin/comments/4gktbr/ssh_ed2551...
I particularly enjoyed this answer:
> ed25519 is more secure in practice. One of the biggest reasons to go with ed25519 is that it's immune to a lot of common side channels. While ed25519 is slightly less complex to crack in theory, in practice both of them are long enough that you're never going to be able to crack it, you need a flaw to exploit in the implementation or a substantial leap forward in cryptanalysis. ed25519 is more secure in practice because most instances of a break in any modern cryptosystem is a flaw in the implementation, ed25519 lowers the attack surface here.