Curve25519

Curve25519 is an elliptic curve designed for efficient Diffie-Hellman key exchange. Introduced by Daniel J. Bernstein in 2005, it is defined over the prime field p = 2^255 − 19 and uses the Montgomery form y^2 = x^3 + 486664 x^2 + x. The curve was selected for fast, secure scalar multiplication and for offering strong resistance to side-channel leakage on common hardware.

In Curve25519, the base point has x-coordinate 9, and the group contains a large prime-order subgroup with cofactor 8. The standard X25519 protocol defines a Diffie-Hellman key agreement that uses Montgomery ladder for constant-time scalar multiplication. Private keys are 32-byte integers that are clamped before use: the three least-significant bits of the first byte are cleared, the most-significant bit of the last byte is cleared, and the second-most-significant bit of the last byte is set. This clamping ensures the scalar lies in the prime-order subgroup and helps prevent certain small-subgroup attacks.

Curve25519 is birationally equivalent to Edwards25519, the Edwards-form counterpart used for signatures (Ed25519). This relationship underpins the widespread use of Curve25519 in both public-key exchange and digital signatures, providing a consistent and efficient ecosystem. The X25519 variant is optimized for secure, fast ECDH, while Ed25519 is optimized for signatures; both are based on the same underlying curve.

Security and performance characteristics include constant-time implementations and robust security under standard assumptions. Curve25519 has become widely adopted in TLS, SSH, and various cryptographic libraries due to its simplicity, speed, and strong security properties.