Class X25519

java.lang.Object

org.bouncycastle.math.ec.rfc7748.X25519

public abstract class X25519
extends Object

A low-level implementation of X25519 (RFC 7748).

Algorithm map.

• generatePrivateKey(SecureRandom, byte[]) — 32 random bytes followed by clampPrivateKey(byte[]) (RFC 7748 sec. 5 clamping: clear bits 254..255 then 0..2, set bit 254).
• generatePublicKey(byte[], int, byte[], int) / scalarMultBase(byte[], int, byte[], int) — computed as k * B on the birationally-equivalent edwards25519 curve via Ed25519.scalarMultBaseYZ(Friend, byte[], int, int[], int[]) (a signed multi-comb in extended Edwards coordinates), then converted to the curve25519 u coordinate using the RFC 7748 sec. 4.1 birational map u = (1 + Y) / (1 - Y) where Y = y / z.
• scalarMult(byte[], int, byte[], int, byte[], int) (key agreement) — Montgomery ladder on XZ-only projective coordinates per RFC 7748 sec. 5, with per-bit constant-time cswap; the A24 = (A + 2) / 4 curve constant is precomputed from A = 486662. The final three doublings correspond to the always-cleared low bits of the scalar; these clear the cofactor to ensure a non-twist result.
• calculateAgreement(byte[], int, byte[], int, byte[], int) — scalarMult(byte[], int, byte[], int, byte[], int) followed by the RFC 7748 sec. 6.1 all-zero rejection.

Side-channel scope. Secret-scalar operations are written to be constant-time at the Java level: the Montgomery ladder in scalarMult(byte[], int, byte[], int, byte[], int) performs identical field operations per bit with branchless cswap; scalarMultBase(byte[], int, byte[], int) routes through the Ed25519 signed-comb, which walks all precomputed entries with mask-based cmov rather than a secret-indexed array load and applies conditional negation by XOR-with-mask; the final modular inverse uses constant-time Mod.modOddInverse. The all-zero rejection in calculateAgreement(byte[], int, byte[], int, byte[], int) runs an OR-accumulator and only leaks the RFC-mandated public rejection criterion. This is sufficient against a remote network timing attacker but is not a substitute for a constant-time native implementation against a co-located cache-line-resolution adversary — JVM-level timing variance from JIT, GC and cache eviction is not addressable in pure Java.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	X25519.Friend

Field Summary

Fields

Modifier and Type	Field	Description
static final int	POINT_SIZE
static final int	SCALAR_SIZE

Constructor Summary

Constructors

Constructor	Description
X25519()

Method Summary

Modifier and Type	Method	Description
static boolean	calculateAgreement(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)
static void	clampPrivateKey(byte[] k)
static void	generatePrivateKey(SecureRandom random, byte[] k)
static void	generatePublicKey(byte[] k, int kOff, byte[] r, int rOff)
static void	precompute()
static void	scalarMult(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)
static void	scalarMultBase(byte[] k, int kOff, byte[] r, int rOff)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

POINT_SIZE

public static final int POINT_SIZE

See Also:

• Constant Field Values

SCALAR_SIZE

public static final int SCALAR_SIZE

See Also:

• Constant Field Values

Constructor Details

X25519

public X25519()

Method Details

calculateAgreement

public static boolean calculateAgreement(byte[] k,
 int kOff,
 byte[] u,
 int uOff,
 byte[] r,
 int rOff)

clampPrivateKey

public static void clampPrivateKey(byte[] k)

generatePrivateKey

public static void generatePrivateKey(SecureRandom random,
 byte[] k)

generatePublicKey

public static void generatePublicKey(byte[] k,
 int kOff,
 byte[] r,
 int rOff)

precompute

public static void precompute()

scalarMult

public static void scalarMult(byte[] k,
 int kOff,
 byte[] u,
 int uOff,
 byte[] r,
 int rOff)

scalarMultBase

public static void scalarMultBase(byte[] k,
 int kOff,
 byte[] r,
 int rOff)