x448

X448 is a Montgomery-form elliptic curve used for Elliptic Curve Diffie-Hellman (ECDH) key exchange. Defined in RFC 7748, it provides a 448-bit prime-field setting designed for high-security public-key operations while enabling efficient computation on a range of platforms.

The curve is defined over the prime field p = 2^448 − 2^224 − 1, in Montgomery form B*y^2 = x^3 + A*x^2 + x, with A = 156326 and B = 1. The x-coordinate on this curve is used for public keys, and the fixed base point has an x-coordinate of 5. The group involved is chosen to support a strong prime-order subgroup suitable for secure key exchange.

X448 uses 56-byte private keys (448 bits). Private keys are typically clamped to avoid leakage from small-subgroup points and to ensure the scalar generates a point in the main subgroup. The shared secret is the x-coordinate of the result of multiplying the other party’s public key by your private scalar, computed via a constant-time Montgomery ladder to resist side-channel leakage.

Security and performance: The large subgroup size provides strong classical security, with a high level of resistance to conventional discrete-log attacks. The Montgomery ladder enables fast, constant-time scalar multiplication, which makes X448 suitable for high-performance implementations on both desktops and embedded devices. Its design emphasizes portability across platforms and predictable timing.

Standards and use: X448 is standardized in RFC 7748 alongside X25519. It is supported by several cryptographic libraries and is used in various protocols as an alternative to X25519, though it is less widely deployed in some ecosystems.

See also: Curve25519, Ed448-Goldilocks, Curve448.