diff --git a/src/transport_layer/secure_channel.c b/src/transport_layer/secure_channel.c
index 8a580d00..7b5598be 100644
--- a/src/transport_layer/secure_channel.c
+++ b/src/transport_layer/secure_channel.c
@@ -390,7 +390,9 @@ sc_status_t sc_derive_ed25519_pubkey(const uint8_t *x25519_privkey, uint8_t *ed2
 uint64_t sc_derive_node_id_from_pubkey(const uint8_t *public_key) {
     if (!public_key) { DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "sc_derive_node_id_from_pubkey: NULL public_key"); return 0; }
     uint8_t sha_hash[SC_HASH_SIZE];
-    SHA256(public_key, SC_PUBKEY_SIZE, sha_hash);
+    if (!SHA256(public_key, SC_PUBKEY_SIZE, sha_hash)) {
+        DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "node identity SHA256 failed"); return 0;
+    }
     uint64_t node_id;
     memcpy(&node_id, sha_hash, 8);
     node_id &= 0x7FFFFFFFFFFFFFFFULL;
@@ -541,19 +543,24 @@ sc_status_t sc_ed25519_sign(const uint8_t privkey[32], const uint8_t* msg, size_
 
 sc_status_t sc_ed25519_verify(const uint8_t pubkey[32], const uint8_t* msg, size_t msg_len, const uint8_t sig[64])
 {
-    if (!pubkey || !msg || !sig) return SC_ERR_INVALID_ARG;
+    if (!pubkey || !msg || !sig) {
+        DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "Ed25519 verify: invalid arguments"); return SC_ERR_INVALID_ARG;
+    }
     EVP_PKEY* pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, NULL, pubkey, 32);
     if (!pkey) { DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "EVP_PKEY_new_raw_public_key failed"); return SC_ERR_CRYPTO; }
     EVP_MD_CTX* ctx = EVP_MD_CTX_new();
     int rc = SC_ERR_CRYPTO;
-    if (ctx) {
-        if (EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey) == 1
-            && EVP_DigestVerify(ctx, sig, 64, msg, msg_len) == 1)
-            rc = SC_OK;
-        else
-            rc = SC_ERR_AUTH_FAILED;
-        EVP_MD_CTX_free(ctx);
+    if (!ctx) DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "Ed25519 verify: context allocation failed");
+    else if (EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey) != 1)
+        DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "Ed25519 verify: initialization failed");
+    else {
+        int verified = EVP_DigestVerify(ctx, sig, 64, msg, msg_len);
+        if (verified == 1) rc = SC_OK;
+        else if (verified == 0) {
+            DEBUG_WARN(DEBUG_CATEGORY_CRYPTO, "Ed25519 verify: signature mismatch"); rc = SC_ERR_AUTH_FAILED;
+        } else DEBUG_ERROR(DEBUG_CATEGORY_CRYPTO, "Ed25519 verify: operation failed rc=%d", verified);
     }
+    EVP_MD_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     return rc;
 }
diff --git a/src/transport_layer/secure_channel.h b/src/transport_layer/secure_channel.h
index 6388c5c1..108cb48c 100644
--- a/src/transport_layer/secure_channel.h
+++ b/src/transport_layer/secure_channel.h
@@ -136,6 +136,9 @@ sc_status_t sc_stream_sign_verify(struct sc_stream_sign_state *state, const uint
 void sc_stream_sign_cleanup(struct sc_stream_sign_state *state);
 
 sc_status_t sc_ed25519_sign(const uint8_t privkey[32], const uint8_t* msg, size_t msg_len, uint8_t sig_out[64]);
+/* Проверить raw Ed25519 подпись: SC_OK — верна, SC_ERR_AUTH_FAILED — не совпала;
+ * SC_ERR_CRYPTO — отказ allocation/init/операции, SC_ERR_INVALID_ARG — NULL вход.
+ * Ошибку операции нельзя трактовать как доказательство повреждения подписанных данных. */
 sc_status_t sc_ed25519_verify(const uint8_t pubkey[32], const uint8_t* msg, size_t msg_len, const uint8_t sig[64]);
 
 /* Вход X25519 private[32], выход Ed25519 public[32]; seed — первые 32 байта SHA512 входа.