Open links in new tab
  1. Wikipedia
    https://en.wikipedia.org/wiki/Curve25519

    Curve25519 - Wikipedia

    • In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security (256-bit key size) and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme. It is one of the fastest curves in ECC, and is not covered by any known patents. The reference implementation is public domain s… See more

    Mathematical properties

    The curve used is , a Montgomery curve, over the prime field defined by the prime number (hence the numeric "25519" in … See more

    History

    In 2005, Curve25519 was first released by Daniel J. Bernstein.
    In 2013, interest began to increase considerably when it was discovered that the NSA had potentially implemented a backdoor into … See more

    Libraries

    • Libgcrypt
    • libssh
    • libssh2 (since version 1.9.0)
    • NaCl
    • GnuTLS … See more

    Protocols

    • OMEMO, a proposed extension for XMPP (Jabber)
    • Secure Shell
    • Signal Protocol
    • Matrix (protocol)… See more

    Hands-on: X25519 Key Exchange
    Learn how to exchange a secret using point operations on the Curve25519 elliptic curve. See examples, calculators, and explanations of the math and security behind X25519.
    Global Web Icon
    https://x25519.xargs.org
    Wikipedia text under CC-BY-SA license
    Feedback
    Table of Contents
    Mathematical properties
    History
    Libraries
    Protocols
     
  1. RFC Editor
    https://www.rfc-editor.org/rfc/rfc7748

    RFC 7748: Elliptic Curves for Security - RFC Editor

  2. openssl.org
    https://docs.openssl.org/3.0/man7/X25519

    X25519 - OpenSSL Documentation

  3. RFC Editor
    https://www.rfc-editor.org/rfc/rfc8410

    RFC 8410: Algorithm Identifiers for Ed25519, Ed448, X25519, and …

  4. pyca/cryptography
    https://cryptography.io/en/latest/hazmat/primitives/asymmetric/x25519

    X25519 key exchange — Cryptography 44.0.0.dev1 documentation

  5. xargs.org
    https://x25519.xargs.org

    Hands-on: X25519 Key Exchange

    Learn how to exchange a secret using point operations on the Curve25519 elliptic curve. See examples, calculators, and explanations of the math and security behind X25519.

  6. People also ask
    When should I use X25519?
    You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns. X25519 is an elliptic curve Diffie-Hellman key exchange using Curve25519. It allows two parties to jointly agree on a shared secret using an insecure channel.

    X25519 key exchange — Cryptography 44.0.0.dev1 documentation

    cryptography.io
    What is the difference between X25519 and X448?
    X25519 is described in Section 6.1 of [CURVES], and X448 is described in Section 6.2 of [CURVES]. Conforming implementations MUST check whether the computed Diffie-Hellman shared secret is the all-zero value, and abort if so, as described in Section 6 of [CURVES].

    RFC 8418 - Use of the Elliptic Curve Diffie-Hellman Key

    datatracker.ietf.org
    What is the key size of X25519?
    A: The key size of X25519 is 256 bits (32 bytes), but five of those bits are "clamped" to fixed values to address various security concerns: This makes a key with strength 251 bits. For further details, see section 4.7 ("Clamping") in Implementing Curve25519/X25519 by Martin Kleppmann.

    Hands-on: X25519 Key Exchange

    x25519.xargs.org
    How does X25519 function work?
    X25519 function produces that value if it operates on an input corresponding to a point with small order, where the order divides the cofactor of the curve (see Section 7). The check may be performed by ORing all the bytes together and checking whether the result is zero, as this eliminates standard side-channels in software implementations.

    RFC 7748: Elliptic Curves for Security - RFC Editor

    rfc-editor.org
    How to check X25519 value?
    The check for the all-zero value results from the fact that the X25519 function produces that value if it operates on an input corresponding to a point with small order, where the order divides the cofactor of the curve (see Section 7). The check may be performed by ORing all the bytes together and checking whether the

    RFC 7748: Elliptic Curves for Security - RFC Editor

    rfc-editor.org
    Why does X25519 choose n 251?
    X25519 chooses n 251 (less than 255 because four bits are set to constant values), making the dificulty of computing the discrete logarithm similar to the dificulty of breaking a 128-bit symmetric cipher. Listing 4 shows how to implement Difie-Hellman.

    Implementing Curve25519/X25519: A Tutorial on Elliptic Curve Cryptog…

    martin.kleppmann.com
    Feedback
  7. IETF Datatracker
    https://datatracker.ietf.org/doc/rfc8031

    RFC 8031 - Curve25519 and Curve448 for the Internet Key …

  8. Information Security Stack Exchange
    https://security.stackexchange.com/questions/50878

    ECDSA vs ECDH vs Ed25519 vs Curve25519 - Information Security …

    How are key exchange and signature algorithms negotiated in TLS 1.3Dec 6, 2021
    What's the deal with X25519 Support in Chrome/Firefox?Aug 10, 2020
    See more results
  9. Martin Kleppmann’s website
    https://martin.kleppmann.com/papers/curve25519.pdf
    [PDF]

    Implementing Curve25519/X25519: A Tutorial on Elliptic …

  10. IETF Datatracker
    https://datatracker.ietf.org/doc/html/rfc8418

    RFC 8418 - Use of the Elliptic Curve Diffie-Hellman Key Agreement ...