Why the world's most trusted encryption curve is built on distrust

Technology · Published 19 October 2026 Swipe more like this →

In short: In the world of cybersecurity, trust is a liability. After concerns emerged that government agencies might have backdoored standard encryption constants, the tech community pivoted toward Curve25519. It is a curve designed not just for speed, but to be mathematically transparent and resistant to implementation errors.

Curve25519 was first released by Daniel J. Bernstein in 2005. It is an elliptic curve designed specifically for the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme. It offers 128 bits of security with a 256-bit key size. One of its primary technical advantages is its speed; it is considered one of the fastest curves in elliptic-curve cryptography (ECC) and is notably free from any known patents. Bernstein later proposed distinguishing the underlying curve from the specific Diffie–Hellman function. The latter is now commonly referred to as X25519. This distinction clarifies the mathematical foundation versus the practical application.

The curve's rise to dominance was fueled by a crisis of confidence in 2013. Cryptographers grew suspicious of NIST-standard constants following revelations that the NSA might have inserted a backdoor into the Dual_EC_DRBG algorithm based on the P-256 curve. Bernstein’s Curve25519 became the de facto alternative because its constants were transparent. Since 2014, major tools like OpenSSH and GnuPG have adopted it, and it was officially standardized for key exchange and signatures in 2020. The curve gained significant traction when NIST announced its inclusion in Special Publication 800-186 in 2017. This move allowed the US Federal Government to officially approve its use. Additionally, the DNSSEC specification was updated in 2017 to include Ed25519 for security.

Technically, Curve25519 is a Montgomery curve defined by the equation y2 = x3 + 486662·x2 + x over a pseudo-Mersenne prime field. It is engineered to avoid common implementation pitfalls. By using a prime order subgroup with a co-factor of 8, it prevents Pohlig–Hellman algorithm attacks. It also utilizes compressed elliptic points, allowing for the efficient use of the Montgomery ladder to perform operations using only X and Z coordinates. A twisted Edwards curve, upon which the Ed25519 signature scheme relies, is birationally equivalent to this curve. This relationship allows for versatile cryptographic applications. Furthermore, the DKIM specification was amended in 2018 to support these specific algorithms.

General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.

Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?

Related

• The mathematical trap that can leak your most private digital keys
• Why modern encryption creates a fundamental clash between personal privacy and state surveillance
• Why modern encryption creates a clash between personal privacy and government surveillance
• How a Cold War encryption standard became the world's first public digital lock
• How a self-described pure mathematician revolutionized the security of the entire internet
• The D-subminiature connector: A 1950s engineering marvel that defined the digital age
• CSS let web pages change their whole look by editing one file
• The 1956 Dartmouth workshop was not the first conference on thinking machines
• Before the 1970s, every secret message relied on a shared key
• The first electrical data links were digital long before computers existed
• From Medieval Monastic Games to Modern Newspaper Puzzles, the Enduring Allure of Cryptograms
• In 1986 barely one percent of stored information was digital

More in Computing and information technology · More in Technology · Latest · A–Z · All topics