Curve25519

The curve used is ${\displaystyle y^{2}=x^{3}+486662x^{2}+x}$, a Montgomery curve, over the prime field defined by the prime number ${\displaystyle 2^{255}-19}$, and it uses the base point ${\displaystyle x=9}$. This point generates a cyclic subgroup whose order is the prime ${\displaystyle 2^{252}+27742317777372353535851937790883648493}$, this subgroup has a co-factor of ${\displaystyle 8}$, meaning the number of elements in the subgroup is ${\displaystyle 1/8}$ that of the elliptic curve group. Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack.[5]

The protocol uses compressed elliptic point (only X coordinates), so it allows efficient use of the Montgomery ladder for ECDH, using only XZ coordinates.[6]

Curve25519 is constructed such that it avoids many potential implementation pitfalls.[7] By design, it is immune to timing attacks and it accepts any 32-byte string as a valid public key and does not require validating that a given point belongs to the curve, or is generated by the base point.

The curve is birationally equivalent to a twisted Edwards curve used in the Ed25519[8][9] signature scheme.[10]

In 2005, Curve25519 was first released by Daniel J. Bernstein.[5]

In 2013, interest began to increase considerably when it was discovered that the NSA had potentially implemented a backdoor into Dual_EC_DRBG.[11] While not directly related,[12] suspicious aspects of the NIST's P curve constants[13] led to concerns[14] that the NSA had chosen values that gave them an advantage in breaking the encryption.[15][16]

"I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry."

— Bruce Schneier, The NSA Is Breaking Most Encryption on the Internet (2013)

Since 2013, Curve25519 has become the de facto alternative to P-256, being used in a wide variety of applications.[17] Starting in 2014, OpenSSH[18] defaults to Curve25519-based ECDH. Behavior for general SSH protocol is still being standardized as of 2018.[19]

In 2017, NIST announced that Curve25519 and Curve448 would be added to Special Publication 800-186, which specifies approved elliptic curves for use by the US Federal Government.[20] Both are described in "RFC 7748".[21] A 2019 draft of "FIPS 186-5" confirms this claim.[22]

In 2018, DKIM specification was amended so as to allow signatures with this algorithm.[23]

Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, Ed25519, X448, and Ed448 algorithms.[24]

• OMEMO, a proposed extension for XMPP (Jabber)[38]
• Secure Shell
• Signal Protocol
• Tox
• Zcash
• Transport Layer Security
• Wireguard

• Official website