Curve25519: New Diffie-Hellman Speed Records

By Daniel J. Bernstein. 2006

1,056 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Information Systems

Citations in the corpus

Riffle (2016, methodology): “We used ElGamal encryption using Curve25519 [11] and Neff’s shuffle [37] with Chaum-Pederson proofs [17] for the verifiable shuffle and decryption.”
Doubly-Efficient zkSNARKs Without Trusted Setup (2018, result): “Our library supports Curve25519 [18], M221, M191, and M159 [2].”
New Software Speed Records for Cryptographic Pairings (2010, methodology): “Inspired by Bernstein’s implementation of Curve25519 [13], we suggest to split such an integer into 12 coefficients each of which will be stored in a double-precision floatingpoint variable in the software implementation.”
High-speed high-security signatures (2011, methodology): “However, like the software in [52], the software in [42] and [51] does not appear to be publicly available.”
Algorand: Scaling Byzantine Agreements for Cryptocurrencies (2017, methodology): “Signatures and VRFs are implemented over Curve 25519 [6], and we use SHA-256 for a hash function.”
Elliptic Curve Cryptography in Practice (2014, methodology): “An implementation using x-coordinate only arithmetic (such as the formulas in [11]) must pay attention to the curve’s twist security (see [2, 3]).”
The Security Impact of a New Cryptographic Library (2012, background): “It was proven in [7] that this scalar-multiplication strategy removes all need to check for special cases inside elliptic-curve additions.”
Full Accounting for Verifiable Outsourcing (2017, methodology): “Curve25519 is a high-performance elliptic curve used in cryptographic protocols [5, 25].”
Stadium: A Distributed Metadata-Private Messaging System (2017, methodology): “In particular, our C++ code implements Bayer and Groth’s verifiable shuffling protocol [3] extended for non-interactive proofs via the Fiat-Shamir Heuristic and instantiated over Bernstein’s Curve25519 elliptic curve group [5].”
Tendermint: Byzantine Fault Tolerance in the Age of Blockchains (2016, methodology): “ED25519 was designed in the open by Dan Bernstein [6], with the intention of being high performance and easy to implement without introducing vulnerabilities.”
DP5: A Private Presence Service (2015, background): “Curve25519 [2]), and securely exchanging the corresponding public keys.”
A Formal Security Analysis of the Signal Messaging Protocol (2017, background): “Signal uses one of two elliptic curves to implement X3DH: curve X25519 [12] or curve X448 [42].”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, background): “6.3 is a high-performance elliptic curve algorithm [6].”
Faster Batch Forgery Identification (2012, methodology): “For elliptic-curve groups with small cofactors the usual way to ensure this is to multiply all input points by the cofactor, such as the cofactor 8 in [3] and [4].”
Post-quantum Key Exchange - A New Hope (2016, neutral): “At this performance it is in the same ballpark as state-of-the-art ECDH software, even when TLS switches to faster 128-bit secure ECDH key exchange based on Curve25519 [13], as recently specified in RFC 7748 [62].”
Scalable Bias-Resistant Distributed Randomness (2017, methodology): “2 We reused existing cothority framework code for CoSi and network communication, and built on the DEDIS advanced crypto library3 for cryptographic operations such as Shamir secret sharing, zero-knowledge proofs, and optimized arithmetic on the popular Curve25519 elliptic curve [5].”
Verifiable ASICs (2016, methodology): “(For efficiency and security, point multiplication uses a Montgomery ladder [21, 34, 85].”
Privacy-Friendly Aggregation for the Smart-Grid (2011, methodology): “It uses the standard library hash function SHA256, and a separate pure-python implementation of Curve25519 [21] for DiffieHellman key generation and derivation yielding 32 byte public keys.”
Sphinx: A Compact and Provably Secure Mix Format (2009, methodology): “The size of the group element can be as small as 32 bytes using Dan Bernstein’s Curve25519 elliptic curve library [3]; the element is the x-coordinate (in GF (2255−19)) of a point on an elliptic curve.”