science

Curve25519

Curve25519 is a science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Curve25519 rather than just read about it. In short: In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security (256-bit key size) and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme, first described and implemented by Daniel J. Bernstein.

Key takeaways

Curve25519 belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Curve25519 to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Curve25519 from memory before moving on to harder problems.

Reference excerpt

In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security (256-bit key size) and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme, first described and implemented by Daniel J. Bernstein. It is one of the fastest curves in ECC, and is not covered by any known patents. The reference implementation is public-domain software. The original Curve25519 paper defined it as a Diffie–Hellman (DH) function. Bernstein has since proposed that the name Curve25519 be used for the underlying curve, and the name X25519 for the DH function.

Mathematical properties The curve used is y 2 = x 3 + 486662 x 2 + x {\displaystyle y^{2}=x^{3}+486662x^{2}+x} , a Montgomery curve, over the prime field defined by the pseudo-Mersenne prime number 2 255 − 19 {\displaystyle 2^{255}-19} (hence the numeric "25519" in the name), and it uses the base point with x = 9 {\displaystyle x=9} . This point generates a cyclic subgroup whose order is the prime 2 252 + 27742317777372353535851937790883648493 {\displaystyle 2^{252}+27742317777372353535851937790883648493} . This subgroup has a co-factor of 8, meaning the number of elements in the subgroup is ⁠1/8⁠ that of the elliptic curve group. Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack. The protocol uses compressed elliptic point (only X coordinates), so it allows efficient use of the Montgomery ladder for ECDH, using only XZ coordinates. Curve25519 is constructed such that it avoids many potential implementation pitfalls. The curve is birationally equivalent to a twisted Edwards curve used in the Ed25519 signature scheme.

History In 2005, Curve25519 was first released by Daniel J. Bernstein. In 2013, interest began to increase considerably when it was discovered that the NSA had potentially implemented a backdoor into the P-256 curve based Dual_EC_DRBG algorithm. While not directly related, suspicious aspects of the NIST's P curve constants led to concerns that the NSA had chosen values that gave them an advantage in breaking the encryption.

"I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry."

Since 2013, Curve25519 has become the de facto alternative to P-256, being used in a wide variety of applications. Starting in 2014, OpenSSH defaults to Curve25519-based ECDH and GnuPG adds support for Ed25519 keys for signing and encryption. The use of the curve was eventually standardized for both key exchange and signature in 2020. In 2017, NIST announced that Curve25519 and Curve448 would be added to Special Publication 800-186, which specifies approved elliptic curves for use by the US Federal Government. Both are described in RFC 7748. A 2019 draft of "FIPS 186-5" notes the intention to allow usage of Ed25519 for digital signatures. The 2023 update of Special Publication 800-186 allows usage of Curve25519. In February 2017, the DNSSEC specification for using Ed25519 and Ed448 was published as RFC 8080, assigning algorithm numbers 15 and 16. In 2018, DKIM specification was amended so as to allow signatures with this algorithm. Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It recommends support for X25519, Ed25519, X448, and Ed448 algorithms. In 2024, Curve25519 has added ML-KEM support.

Libraries

Protocols OMEMO, a proposed extension for XMPP (Jabber) Secure Shell Signal Protocol Matrix (protocol) Tox Zcash Transport Layer Security WireGuard

Applications

Notes

References

External links Official website

Worked examples

Example 1 — a first encounter with Curve25519

Start with the simplest possible case. Write down what Curve25519 claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Curve25519 before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Curve25519 ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Curve25519

In research: Curve25519 appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Curve25519 in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Curve25519 is common in secondary-school and first-year university syllabi. It links to neighbouring topics Elliptic curves, so understanding it makes those chapters shorter.
In everyday life: Look for Curve25519 outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Curve25519” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Curve25519 in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Curve25519 means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Curve25519 out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Curve25519 in simple terms?

Why does Curve25519 matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Curve25519?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Curve25519.