Curve25519 field arithmetic + X25519 (RFC 7748) for the curve25519-sha256 KEX. More...

#include <stddef.h>
#include <stdint.h>

Typedefs
typedef int64_t	ssh_gf[16]
	A field element of GF(2^255 - 19): 16 limbs, radix 2^16 (limb i weighs 2^(16i)).

Functions
void	ssh_gf_copy (ssh_gf out, const ssh_gf in)
	out = in

void	ssh_gf_add (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a + b (unreduced)

void	ssh_gf_sub (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a - b (unreduced)

void	ssh_gf_mul (ssh_gf out, const ssh_gf a, const ssh_gf b)
	out = a * b mod p

void	ssh_gf_sq (ssh_gf out, const ssh_gf a)
	out = a^2 mod p

void	ssh_gf_inv (ssh_gf out, const ssh_gf a)
	out = a^-1 mod p (= a^(p-2))

void	ssh_gf_pack (uint8_t out[32], const ssh_gf a)
	canonical little-endian 32-byte encoding

void	ssh_gf_unpack (ssh_gf out, const uint8_t in[32])
	decode 32 bytes (high bit ignored)

void	ssh_gf_cswap (ssh_gf p, ssh_gf q, int b)
	constant-time conditional swap of p,q when b==1

void	ssh_x25519 (uint8_t out[32], const uint8_t scalar[32], const uint8_t point[32])
	X25519 scalar multiplication: `out` = `scalar` * `point` (RFC 7748 §5).

void	ssh_x25519_base (uint8_t out[32], const uint8_t scalar[32])
	X25519 with the standard base point u=9: `out` = `scalar` * G.

Detailed Description

Curve25519 field arithmetic + X25519 (RFC 7748) for the curve25519-sha256 KEX.

Field elements are GF(2^255 - 19) in a portable radix-2^16 representation (sixteen int64 limbs), so no 128-bit integer type is needed - important because 32-bit xtensa (ESP32) gcc has no __int128. The same field arithmetic backs Ed25519 (ssh_ed25519), so the field ops are exported here. Correctness is pinned to the RFC 7748 §5.2 test vectors (test_ssh_ed25519). No heap; all state is on the stack.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file ssh_curve25519.h.

Typedef Documentation

◆ ssh_gf

typedef int64_t ssh_gf[16]

A field element of GF(2^255 - 19): 16 limbs, radix 2^16 (limb i weighs 2^(16i)).

Definition at line 25 of file ssh_curve25519.h.

Function Documentation

◆ ssh_gf_copy()

void ssh_gf_copy	(	ssh_gf	out,
		const ssh_gf	in
	)

out = in

Definition at line 50 of file ssh_curve25519.cpp.

Referenced by ssh_gf_pack().

◆ ssh_gf_add()

void ssh_gf_add	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a + b (unreduced)

Definition at line 56 of file ssh_curve25519.cpp.

Referenced by ssh_x25519().

◆ ssh_gf_sub()

void ssh_gf_sub	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a - b (unreduced)

Definition at line 62 of file ssh_curve25519.cpp.

Referenced by ssh_x25519().

◆ ssh_gf_mul()

void ssh_gf_mul	(	ssh_gf	out,
		const ssh_gf	a,
		const ssh_gf	b
	)

out = a * b mod p

Definition at line 166 of file ssh_curve25519.cpp.

Referenced by ssh_gf_sq(), and ssh_x25519().

◆ ssh_gf_sq()

void ssh_gf_sq	(	ssh_gf	out,
		const ssh_gf	a
	)

out = a^2 mod p

Definition at line 191 of file ssh_curve25519.cpp.

References ssh_gf_mul().

Referenced by ssh_x25519().

◆ ssh_gf_inv()

void ssh_gf_inv	(	ssh_gf	out,
		const ssh_gf	a
	)

out = a^-1 mod p (= a^(p-2))

Definition at line 228 of file ssh_curve25519.cpp.

References ssh_gf_pack(), and ssh_gf_unpack().

Referenced by ssh_x25519().

◆ ssh_gf_pack()

void ssh_gf_pack	(	uint8_t	out[32],
		const ssh_gf	a
	)

canonical little-endian 32-byte encoding

Definition at line 281 of file ssh_curve25519.cpp.

References ssh_gf_copy(), and ssh_gf_cswap().

Referenced by ssh_gf_inv(), and ssh_x25519().

◆ ssh_gf_unpack()

void ssh_gf_unpack	(	ssh_gf	out,
		const uint8_t	in[32]
	)

decode 32 bytes (high bit ignored)

Definition at line 310 of file ssh_curve25519.cpp.

Referenced by ssh_gf_inv(), and ssh_x25519().

◆ ssh_gf_cswap()

void ssh_gf_cswap	(	ssh_gf	p,
		ssh_gf	q,
		int	b
	)

constant-time conditional swap of p,q when b==1

Definition at line 268 of file ssh_curve25519.cpp.

Referenced by ssh_gf_pack(), and ssh_x25519().

◆ ssh_x25519()

void ssh_x25519	(	uint8_t	out[32],
		const uint8_t	scalar[32],
		const uint8_t	point[32]
	)

X25519 scalar multiplication: out = scalar * point (RFC 7748 §5).

scalar and point are 32-byte little-endian; the scalar is clamped internally. out may alias neither input. Constant-time in the scalar (Montgomery ladder with conditional swaps).

Definition at line 394 of file ssh_curve25519.cpp.

References ssh_gf_add(), ssh_gf_cswap(), ssh_gf_inv(), ssh_gf_mul(), ssh_gf_pack(), ssh_gf_sq(), ssh_gf_sub(), and ssh_gf_unpack().

Referenced by ssh_kexdh_handle(), and ssh_x25519_base().