View source for Curve25519

In [[cryptography]], '''Curve25519''' is an [[elliptic curve cryptography|elliptic curve]] offering 128 bits of security and designed for use with the [[elliptic curve Diffie–Hellman]] (ECDH) key agreement scheme.  It is one of the fastest ECC curves and is not covered by any known patents.<ref name=":1">{{Cite web|title = Irrelevant patents on elliptic-curve cryptography|url = https://cr.yp.to/ecdh/patents.html|website = cr.yp.to|accessdate = 2016-02-08|publisher = |last = Bernstein}}</ref> The [[reference implementation]] is [[public domain software]].<ref>[https://cr.yp.to/ecdh.html A state-of-the-art Diffie-Hellman function] by [[Daniel J. Bernstein]]''"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain. "''</ref>

The original Curve25519 paper defined it as a [[Diffie–Hellman]] (DH) function. [[Daniel J. Bernstein]] has since proposed that the name Curve25519 be used for the underlying curve, and the name '''X25519''' for the DH function.<ref>{{cite web|url=https://www.ietf.org/mail-archive/web/cfrg/current/msg04996.html|title=[Cfrg] 25519 naming|accessdate=2016-02-25}}</ref>

== Mathematical properties ==
The curve used is <math>y^2 = x^3 + 486662x^2 + x</math>, a [[Montgomery curve]], over the prime field defined by the [[prime number]] <math>2^{255} - 19</math>, and it uses the base point <math>x = 9</math>. This point generates a cyclic subgroup whose [[Order (group theory)|order]] is the prime <math>2^{252} + 27742317777372353535851937790883648493</math> and is of index <math>8</math>. Using a prime order subgroup prevents mounting a [[Pohlig–Hellman algorithm]] attack.<ref name=":2" />

The protocol uses compressed elliptic point (only ''X'' coordinates), so it allows efficient use of the [[Montgomery ladder]] for [[elliptic curve Diffie–Hellman|ECDH]], using only ''XZ'' coordinates.<ref>{{cite web|title=EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves|last1=Lange|first1=Tanja|author1-link=Tanja Lange|url=https://www.hyperelliptic.org/EFD/g1p/auto-montgom-xz.html|website=EFD / Explicit-Formulas Database |accessdate=8 February 2016}}</ref>

Curve25519 is constructed such that it avoids many potential implementation pitfalls.<ref>{{Cite web|title = SafeCurves: Introduction|url = https://safecurves.cr.yp.to|website = safecurves.cr.yp.to|accessdate = 2016-02-08}}</ref> By design, it is immune to timing attacks and it accepts any 32-byte string as a valid public key and does not require validating that a given point belongs to the curve, or is generated by the base point.

The curve is [[Birational geometry|birationally equivalent]] to a [[twisted Edwards curve]] used in [[Ed25519]]<ref>{{Cite web|url=http://ed25519.cr.yp.to/|title=Ed25519: high-speed high-security signatures|author=Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang | date=2017-01-22|accessdate=2019-11-09}}</ref><ref>{{Cite web|url=http://ed25519.cr.yp.to/ed25519-20110926.pdf|title=High-speed high-security signatures|author=Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang | date=2011-09-26|accessdate=2019-11-09}}</ref> signature scheme.<ref>{{cite conference |last1=Bernstein|first1=Daniel J.|authorlink1=Daniel J. Bernstein|last2=Lange|first2=Tanja|title=Faster addition and doubling on elliptic curves|pages=29–50|url=https://eprint.iacr.org/2007/286 | doi=10.1007/978-3-540-76900-2_3 | series=Lecture Notes in Computer Science | publisher=Springer | location=Berlin | conference=Advances in cryptology—ASIACRYPT | year=2007 | isbn=978-3-540-76899-9 | mr=2565722 | volume=4833 | editor1-first=Kaoru | editor1-last=Kurosawa}}</ref>

== Popularity ==
Curve25519 was first released by [[Daniel J. Bernstein]] in 2005,<ref name=":2">{{cite conference |last=Bernstein |first=Daniel J. |authorlink=Daniel J. Bernstein | title=Curve25519: New Diffie-Hellman Speed Records |year=2006 | url=https://cr.yp.to/ecdh/curve25519-20060209.pdf |conference=Public Key Cryptography |series=Lecture Notes in Computer Science |volume=3958 |pages=207–228 |location=New York |publisher=Springer |isbn=978-3-540-33851-2 |doi=10.1007/11745853_14 | mr=2423191 | editor1-first=Moti | editor1-last=Yung | editor2-first=Yevgeniy | editor2-last=Dodis | editor3-first=Aggelos | editor3-last=Kiayias | editor4-first=Tal |display-editors = 3 | editor4-last=Malkin}}</ref> but interest increased considerably after 2013 when it was discovered that the [[NSA]] had potentially implemented a backdoor into [[Dual_EC_DRBG]]<ref>{{Cite web|url=https://csrc.nist.gov/csrc/media/projects/crypto-standards-development-process/documents/dualec_in_x982_and_sp800-90.pdf|title=Dual EC in X9.82 and SP 800-90|last=Kelsey|first=John|date=May 2014|website=National Institute of Standards in Technology|access-date=December 2, 2018}}</ref>. While not directly related,<ref>{{Cite web|title = A Few Thoughts on Cryptographic Engineering: The Many Flaws of Dual_EC_DRBG|url = http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html|website = blog.cryptographyengineering.com|accessdate = 2015-05-20|last = Green|first = Matthew|date = January 14, 2015}}</ref> suspicious aspects of the NIST's P curve constants<ref>https://safecurves.cr.yp.to/</ref> led to concerns<ref>{{Cite web|url = https://lists.torproject.org/pipermail/tor-talk/2013-September/029956.html|title = [tor-talk] NIST approved crypto in Tor?|date = 2013-09-08|accessdate = 2015-05-20|first = Gregory|last = Maxwell}}</ref> that the NSA had chosen values that gave them an advantage in breaking the encryption.<ref>{{Cite web|title = SafeCurves: Rigidity|url = https://safecurves.cr.yp.to/rigid.html|website = safecurves.cr.yp.to|accessdate = 2015-05-20}}</ref><ref>{{Cite web|title = The NSA Is Breaking Most Encryption on the Internet - Schneier on Security|url = https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929|website = www.schneier.com|accessdate = 2015-05-20}}</ref>

{{Quote|I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry.
|author=[[Bruce Schneier]] |title=The NSA Is Breaking Most Encryption on the Internet (2013)}}

Since then, Curve25519 has become the de facto alternative to P-256, and is used in a wide variety of applications.<ref>{{cite web|url=https://ianix.com/pub/curve25519-deployment.html|title=Things that use Curve25519|accessdate=2015-12-23}}</ref>  Starting in 2014, OpenSSH<ref name=":0">{{cite web|url=https://www.libssh.org/2013/11/03/openssh-introduces-curve25519-sha256libssh-org-key-exchange/|title=OpenSSH introduces curve25519-sha256@libssh.org key exchange ! |first=Aris |last=Adamantiadis |date=2013-11-03 |work=libssh.org |accessdate=2014-12-27}}</ref> defaults to Curve25519-based [[ECDH]]. Behavior for general SSH protocol is still being standardized as of 2018.<ref>{{cite ietf |draft=draft-ietf-curdle-ssh-curves-08 |title=Secure Shell (SSH) Key Exchange Method using Curve25519 and Curve448 |author1=A. Adamantiadis |author2=libssh |author3=S. Josefsson |author4=SJD AB |author5=M. Baushke |author6=Juniper Networks, Inc. |date=2018-06-26}}</ref>

In 2017, NIST announced that Curve25519 and [[Curve448]] would be added to Special Publication 800-186, which specifies approved elliptic curves for use by the US Federal Government.<ref>{{Cite web|url=https://csrc.nist.gov/News/2017/Transition-Plans-for-Key-Establishment-Schemes|title=Transition Plans for Key Establishment Schemes {{!}} CSRC|last=Computer Security Division|first=Information Technology Laboratory|date=2017-10-31|website=CSRC {{!}} NIST|language=EN-US|access-date=2019-09-04}}</ref> Both are described in [https://tools.ietf.org/html/rfc7748 RFC 7748].

In 2018, [[DKIM]] specification was amended so as to allow signatures with this algorithm.<ref>{{cite IETF |title=A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM) |rfc=8463 |author=John Levine |date=September 2018 |publisher=[[Internet Engineering Task Force|IETF]]}}</ref>

In 2018, RFC 8446 was published as the new [[Transport Layer Security#TLS_1.3|Transport Layer Security v1.3]] standard and it requires mandatory support for X25519, Ed25519 and X448, Ed448 algorithms.<ref>{{cite IETF |title=The Transport Layer Security (TLS) Protocol Version 1.3 |rfc=8446 |author=E Rescorla|date=September 2018 |publisher=[[Internet Engineering Task Force|IETF]]}}</ref>

=== Libraries ===
{{div col}}
* [[Libgcrypt]]<ref>{{cite web |url=https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000386.html |title=Libgcrypt 1.7.0 release announcement |author=[[Werner Koch]] |date=15 April 2016 |accessdate=22 April 2016}}</ref>  
* libssh<ref name=":0"/><ref name="sshcompare">{{cite web|url=http://ssh-comparison.quendi.de/comparison/kex.html|title=Comparison of key exchange methods|author=SSH implementation comparison|accessdate=2016-02-25}}</ref>
* [[libssh2]] (since version 1.9.0)
* [[NaCl (software)|NaCl]]<ref>{{cite web|url=https://nacl.cr.yp.to/|title=Introduction|date=|work=yp.to|accessdate=11 December 2014}}</ref>
* [[GnuTLS]]<ref>{{Cite web|title = nettle: curve25519.h File Reference - doxygen documentation {{!}} Fossies Dox|url = http://fossies.org/dox/nettle-3.1.1/curve25519_8h.html|website = fossies.org|accessdate = 2015-05-19|url-status = dead|archiveurl = https://web.archive.org/web/20150520171756/http://fossies.org/dox/nettle-3.1.1/curve25519_8h.html|archivedate = 2015-05-20}}</ref>
* [[mbed TLS]] (formerly PolarSSL)<ref>{{Cite web|title = PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL)|url = https://tls.mbed.org/tech-updates/releases/polarssl-1.3.3-released|website = tls.mbed.org|accessdate = 2015-05-19|first = ARM|last = Limited}}</ref>
* [[wolfSSL]]<ref>{{cite web|url=https://www.wolfssl.com/wolfSSL/Products-wolfssl.html|title=wolfSSL Embedded SSL/TLS Library - wolfSSL Products|publisher=}}</ref>
* [[Botan (programming library)|Botan]]<ref>{{cite web|url=http://botan.randombit.net/doxygen/curve25519_8cpp_source.html|title=Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File|website=botan.randombit.net}}</ref>
* [[SChannel]]{{efn|Starting with Windows 10 (1607), Windows Server 2016|name=|group=}}<ref>{{Cite web|url=https://docs.microsoft.com/en-us/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server|title=TLS (Schannel SSP)|last=Justinha|website=docs.microsoft.com|language=en-us|access-date=2017-09-15}}</ref>
* [[Libsodium]]<ref>{{cite web|url=https://libsodium.org|title=Introduction · libsodium|first=Frank|last=Denis|website=libsodium.org}}</ref>
* [[OpenSSL]] since version 1.1.0<ref>{{Cite web|url=https://www.openssl.org/news/openssl-1.1.0-notes.html|title=OpenSSL|last=Inc.|first=OpenSSL Foundation,|website=www.openssl.org|access-date=2016-06-24}}</ref>
* [[LibreSSL]]<ref>{{cite web|url=https://github.com/openbsd/src/commit/0ad90c3e6b15b9b6b8463a8a0f87d70c83a07ef4|title=Add support for ECDHE with X25519. · openbsd/src@0ad90c3|website=GitHub}}</ref>
* NaCl for Tcl — a port to the Tcl language.<ref>{{cite web|url=http://wiki.tcl.tk/47681 | title= Tclers Wiki - NaCl for Tcl}}</ref>{{third-party inline|date=August 2016}}
* [[Network Security Services|NSS]] since version 3.28<ref>{{Cite web|url=https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28_release_notes|title=NSS 3.28 release notes|accessdate=25 July 2017}}</ref>
* [[Crypto++]]
{{div col end}}

=== Protocols ===
* [[OMEMO]], a proposed extension for [[XMPP]] (Jabber)<ref>{{cite web|url=https://conversations.im/xeps/multi-end.html#usecases-setup|title=OMEMO Encryption|first=Andreas|last=Straub|date=25 October 2015|website=conversations.im}}</ref>
* [[Secure Shell]]
* [[Signal Protocol]]
* [[Tox (protocol)|Tox]]
* [[Zcash]]
* [[Transport Layer Security]]

=== Applications ===
<!-- PLEASE RESPECT ALPHABETICAL ORDER -->
{{div col|colwidth=16em}}
* [[Conversations (software)|Conversations Android application]]{{efn|name=OMEMO|Via the [[OMEMO]] protocol}}
* [[Cryptocat]]<ref>{{Cite web|url=https://crypto.cat/security.html#encryption|title=Cryptocat - Security|website=crypto.cat|access-date=2016-05-24|archive-url=https://web.archive.org/web/20160407125207/https://crypto.cat/security.html#encryption|archive-date=2016-04-07|url-status=dead}}</ref>{{efn|name=OMEMO}}
* [[DNSCrypt]]<ref>{{cite web|url=https://github.com/jedisct1/dnscrypt-proxy/blob/master/DNSCRYPT-V2-PROTOCOL.txt/|title=DNSCrypt version 2 protocol specification|author=Frank Denis|accessdate=2016-03-03|archive-url=https://web.archive.org/web/20150813075450/https://github.com/jedisct1/dnscrypt-proxy/blob/master/DNSCRYPT-V2-PROTOCOL.txt|archive-date=2015-08-13|url-status=dead}}</ref>
* [[DNSCurve]]
* [[Dropbear (software)|Dropbear]]<ref name="sshcompare" /><ref>{{cite web|url=https://matt.ucc.asn.au/dropbear/CHANGES|title=Dropbear SSH - Changes|author=Matt Johnston|accessdate=2016-02-25}}</ref>
* [[Facebook Messenger]] {{efn|Only in "secret conversations"}}{{efn|name=SIGNAL|Via the [[Signal Protocol]]}}
* [[Gajim]] via plugin<ref name="gajim-omemo">{{cite web|url= https://github.com/omemo/gajim-omemo|title= Gajim plugin for OMEMO Multi-End Message and Object Encryption|author= Bahtiar Gadimov|display-authors=etal|accessdate= 2016-10-01}}</ref>{{efn|name=OMEMO}}
* [[GNUnet]]<ref>{{cite web|url=https://gnunet.org/gnunet0-10-0|title=GNUnet 0.10.0|date=|work=gnunet.org|accessdate=11 December 2014}}</ref>
* [[GnuPG]]
* [[Google Allo]]{{efn|Only in "incognito mode"}}{{efn|name=SIGNAL}}
* [[I2P]]<ref>{{cite web|url=https://geti2p.net/en/blog/post/2014/09/20/0.9.15-Release|title=0.9.15 Release - Blog|author=zzz|date=2014-09-20|work=|accessdate=20 December 2014}}</ref>
* [[IPFS]]<ref>https://github.com/ipfs/go-ipfs/blob/master/core/commands/keystore.go#L68</ref>
* [[iOS]]<ref>{{cite web|url=https://www.apple.com/business/docs/iOS_Security_Guide.pdf|title=iOS Security Guide|publisher=}}</ref>
* [[Monero (cryptocurrency)|Monero]]<ref>{{cite web|url=https://lab.getmonero.org/pubs/MRL-0003.pdf|title=MRL-0003 - Monero is Not That Mysterious|website=getmonero.com}}</ref>
* [[OpenBSD]]{{efn|Used to sign releases and packages<ref>{{cite web |url=http://bsd.slashdot.org/story/14/01/19/0124202/openbsd-moving-towards-signed-packages-based-on-d-j-bernstein-crypto |title= OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto |first=Constantine A. |last=Murenin |editor=Soulskill |date=2014-01-19 |accessdate=2014-12-27 |publisher=[[Slashdot]]}}</ref><ref>{{cite web |url=http://bsd.slashdot.org/story/14/05/01/1656209/openbsd-55-released |title= OpenBSD 5.5 Released |first=Constantine A. |last=Murenin |editor=timothy |date=2014-05-01 |accessdate=2014-12-27 |publisher=[[Slashdot]]}}</ref>}}
* [[OpenSSH]]<ref name="sshcompare" />{{efn|Exclusive key exchange in OpenSSH 6.7 when compiled without [[OpenSSL]].<ref>{{cite web |url=http://bxr.su/OpenBSD/usr.bin/ssh/kex.c#kexalgs |title=ssh/kex.c#kexalgs |first=Markus |last=Friedl |website=BSD Cross Reference, OpenBSD src/usr.bin/ |date=2014-04-29 |accessdate=2014-12-27 }}</ref><ref>{{cite web |url=http://it.slashdot.org/story/14/04/30/1822209/openssh-no-longer-has-to-depend-on-openssl |title= OpenSSH No Longer Has To Depend On OpenSSL |first=Constantine A. |last=Murenin |editor=Soulskill |date=2014-04-30 |accessdate=2014-12-26 |publisher=[[Slashdot]]}}</ref>}}
* [[Peerio]]<ref>{{cite web|url=https://peerio.zendesk.com/hc/en-us/articles/204155895-How-does-Peerio-implement-end-to-end-encryption|title=How does Peerio implement end-to-end encryption?|website=Peerio}}</ref>
* [[PuTTY]]<ref>{{cite web|url=http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html|title=PuTTY Change Log|website=www.chiark.greenend.org.uk}}</ref>
* [[Signal (software)|Signal]]{{efn|name=SIGNAL}}
* [[Silent Circle (software)|Silent Phone]]
* [[SmartFTP]]<ref name="sshcompare" />
* SSHJ<ref name="sshcompare" />
* [[Threema|Threema Instant Messenger]]<ref>{{cite web|url=https://threema.ch/press-files/cryptography_whitepaper.pdf|title=Threema Cryptography Whitepaper|publisher=}}</ref>
* TinySSH<ref name="sshcompare" />
* TinyTERM<ref name="sshcompare" />
* [[Tor (anonymity network)|Tor]]<ref>{{cite web|url=https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt?id=b5b771b19df9fc052b424228045409467a7b6414#n81|title=Tor's Protocol Specifications - Blog|author=Roger Dingledine & Nick Mathewson|date=|work=|accessdate=20 December 2014}}</ref>
* [[Viber]]<ref>{{cite web|title=Viber Encryption Overview|url=https://www.viber.com/en/security-overview|publisher=Viber|accessdate=24 September 2016|date=3 May 2016}}</ref>
* [[WhatsApp]]{{efn|name=SIGNAL}}<ref>{{Cite web|url=https://arxiv.org/pdf/1701.06817.pdf|title=WhatsApp security and role of metadata in preserving privacy|author=Nidhi Rastogi, James Hendler| date=2017-01-24|accessdate=2019-11-09}}</ref>
* [[Wire (software)|Wire]]
* [[WireGuard]]
{{end div col}}

== Notes ==
{{notelist}}

== See also ==
*[[Curve448]]
*[[EdDSA#Ed25519|EdDSA § Ed25519]]

== References ==
{{reflist|30em}}

== External links ==

* {{official website|https://cr.yp.to/ecdh.html}} 

[[Category:Elliptic curve cryptography]]
[[Category:Public-domain software with source code]]