Curve25519
In cryptography, Curve25519 is an elliptic curve offering 128 bits of security (256 bits key size) and designed for use with the elliptic curve Diffie–Hellman (ECDH) key agreement scheme.  It is one of the fastest ECC curves and is not covered by any known patents. The reference implementation is public domain software.

The original Curve25519 paper defined it as a Diffie–Hellman (DH) function. Daniel J. Bernstein has since proposed that the name Curve25519 be used for the underlying curve, and the name X25519 for the DH function.

Mathematical properties 
The curve used is , a Montgomery curve, over the prime field defined by the prime number , and it uses the base point . This point generates a cyclic subgroup whose order is the prime , this subgroup has a co-factor of , meaning the number of elements in the subgroup is  that of the elliptic curve group. Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack.

The protocol uses compressed elliptic point (only X coordinates), so it allows efficient use of the Montgomery ladder for ECDH, using only XZ coordinates.

Curve25519 is constructed such that it avoids many potential implementation pitfalls. By design, it is immune to timing attacks and it accepts any 32-byte string as a valid public key and does not require validating that a given point belongs to the curve, or is generated by the base point.

The curve is birationally equivalent to a twisted Edwards curve used in the Ed25519 signature scheme.

History 
In 2005, Curve25519 was first released by Daniel J. Bernstein.

In 2013, interest began to increase considerably when it was discovered that the NSA had potentially implemented a backdoor into the P-256 curve based Dual_EC_DRBG algorithm. While not directly related, suspicious aspects of the NIST's P curve constants led to concerns that the NSA had chosen values that gave them an advantage in breaking the encryption.

Since 2013, Curve25519 has become the de facto alternative to P-256, being used in a wide variety of applications. Starting in 2014, OpenSSH defaults to Curve25519-based ECDH and GnuPG adds support for Ed25519 keys for signing and encryption. Behavior for general SSH protocol is still being standardized as of 2018.

In 2017, NIST announced that Curve25519 and Curve448 would be added to Special Publication 800-186, which specifies approved elliptic curves for use by the US Federal Government. Both are described in RFC 7748. A 2019 draft of "FIPS 186-5" confirms this claim.

In 2018, DKIM specification was amended so as to allow signatures with this algorithm.

Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, Ed25519, X448, and Ed448 algorithms.

Libraries 

 Libgcrypt  
 libssh
 libssh2 (since version 1.9.0)
 NaCl
 GnuTLS
 mbed TLS (formerly PolarSSL)
 wolfSSL
 Botan
 SChannel
 Libsodium
 OpenSSL since version 1.1.0
 LibreSSL
 NaCl for Tcl — a port to the Tcl language.
 NSS since version 3.28
 Crypto++
 curve25519-dalek

 Bouncy Castle

Protocols 
 OMEMO, a proposed extension for XMPP (Jabber)
 Secure Shell
 Signal Protocol
 Matrix (protocol)
 Tox
 Zcash
 Transport Layer Security
 Wireguard

Applications 

 Conversations Android application
 Cryptocat
 DNSCrypt
 DNSCurve
 Dropbear
 Facebook Messenger 
 Gajim via plugin
 GNUnet
 GnuPG
 Google Allo
 I2P
 IPFS
 iOS
 Monero
 OpenBSD
 OpenSSH
 Peerio
 ProtonMail
 PuTTY
 Signal
 Silent Phone
 SmartFTP
 SSHJ
 SQRL
 Threema Instant Messenger
 TinySSH
 TinyTERM
 Tor
 Viber
 WhatsApp
 Wire
 WireGuard

Notes

References

External links 
 

Elliptic curve cryptography
Public-domain software with source code
Elliptic curves