Other meanings of Curve25519
PUBLIC-KEY CRYPTOGRAPHY
Curve25519 is an elliptic-curve cryptographic scheme designed by Daniel J. Bernstein for efficient Diffie–Hellman key exchange. It uses arithmetic on a Montgomery curve over the prime field defined by 2255 − 19 and became a foundation for modern protocols through the standardized X25519 function.
Curve25519 is a Montgomery-form elliptic curve and a Diffie–Hellman construction optimized for fast, constant-time scalar multiplication. Bernstein introduced it in 2006 as a practical alternative to older elliptic-curve key-exchange choices, emphasizing speed, simple implementation, and resistance to common implementation errors.
The construction works over the prime field whose modulus is 2255 − 19. Its Montgomery equation is commonly written as y2 = x3 + 486662x2 + x, with the standard base-point x-coordinate 9. Implementations normally transmit only the u- or x-coordinate and use a Montgomery ladder, avoiding the need to represent or manipulate a full point during key exchange.1
Curve25519 key exchange derives a shared secret by multiplying a public curve point by a private scalar. Each party publishes a public value; multiplying that value by the other party’s private scalar produces the same field element on both sides, assuming the private values and protocol roles are handled correctly.
The modern protocol-facing name is X25519. RFC 7748 specifies X25519 and X448, including scalar decoding, clamping, the Montgomery ladder, and rules for accepting noncanonical field representations.1 The scalar-processing rules clear and set selected bits so that the scalar lies in the appropriate subgroup-related form. X25519 is a primitive, not a complete authenticated protocol: applications must authenticate public keys and combine the result with a key-derivation function and transcript context.
Curve25519’s security depends on both the elliptic-curve problem and correct protocol composition. The curve was selected to provide a large prime-order subgroup while making exceptional cases and complete, constant-time ladder implementations comparatively manageable. Its design also avoids reliance on opaque, unexplained curve-generation constants, a concern that influenced later cryptographic engineering.
X25519 is widely used in contemporary secure communications and transport protocols, including the key-agreement portions of TLS 1.3 and several messaging systems. RFC 7748 recommends checking for an all-zero shared output when an application needs to reject small-order or otherwise invalid public inputs, although protocol specifications determine the exact validation policy.1 Confidentiality still requires authenticated encryption; Curve25519 alone does not provide identity authentication, signatures, or message integrity.
Curve25519 and Ed25519 are related but distinct constructions. Ed25519 is a signature scheme using a twisted Edwards representation of a closely related underlying curve, while Curve25519 refers to the Montgomery-based key-exchange design; conversion between representations is possible but does not make the protocols interchangeable.2
The name also hides several layers of terminology. “Curve25519” often denotes the original curve and its associated Diffie–Hellman method, whereas “X25519” denotes the standardized scalar-multiplication interface. The 255-bit field does not mean that every output provides 255 bits of symmetric security, and the cofactor of 8 means that subgroup handling remains a protocol concern. Implementations can use optimized field representations such as radix-25.5 or radix-51, but these are implementation choices rather than different curves. Libraries such as libsodium expose X25519 through higher-level key-exchange APIs, reducing the need for application developers to perform point arithmetic directly.3
Curve25519 is a cryptographic construction and key-exchange primitive; secure applications must supply authentication, key derivation, and authenticated encryption around it.
Help improve the encyclopedia. Reports go straight to the site manager.