Lably
Skip to content

Curve25519

Elliptic curve used in Internet cryptography

  • 3 min read
  • 5 chapters

Related on Lably

Through De facto and de jure

The original Curve25519 paper defined it as a Diffie–Hellman (DH) function. Bernstein has since proposed that the name Curve25519 be used for the underlying curve, and the name X25519 for the DH function.

Mathematical properties

The curve used is y2 = x3 + 486662·x2 + x, a Montgomery curve, over the prime field defined by the pseudo-Mersenne prime number 2255−19 (hence the numeric "25519" in the name), and it uses the base point with x=9. This point generates a cyclic subgroup whose order is the prime 2252+27742317777372353535851937790883648493. This subgroup has a co-factor of 8, meaning the number of elements in the subgroup is ⁠1/8⁠ that of the elliptic curve group. Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack.

The protocol uses compressed elliptic point (only X coordinates), so it allows efficient use of the Montgomery ladder for ECDH, using only XZ coordinates.

Curve25519 is constructed such that it avoids many potential implementation pitfalls.

The curve is birationally equivalent to a twisted Edwards curve used in the Ed25519 signature scheme.

Sign in to keep reading

4 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard