curve25519.h File Reference

Curve25519 field arithmetic + X25519 (RFC 7748) for the curve25519-sha256 KEX. More...

#include <stddef.h>
#include <stdint.h>

Go to the source code of this file.

Typedefs
typedef int64_t	pc_gf[16]
	A field element of GF(2^255 - 19): 16 limbs, radix 2^16 (limb i weighs 2^(16i)).

Functions
void	pc_gf_copy (pc_gf out, const pc_gf in)
	out = in
void	pc_gf_add (pc_gf out, const pc_gf a, const pc_gf b)
	out = a + b (unreduced)
void	pc_gf_sub (pc_gf out, const pc_gf a, const pc_gf b)
	out = a - b (unreduced)
void	pc_gf_mul (pc_gf out, const pc_gf a, const pc_gf b)
	out = a * b mod p
void	pc_gf_sq (pc_gf out, const pc_gf a)
	out = a^2 mod p
void	pc_gf_inv (pc_gf out, const pc_gf a)
	out = a^-1 mod p (= a^(p-2))
void	pc_gf_pack (uint8_t out[32], const pc_gf a)
	canonical little-endian 32-byte encoding
void	pc_gf_unpack (pc_gf out, const uint8_t in[32])
	decode 32 bytes (high bit ignored)
void	pc_gf_cswap (pc_gf p, pc_gf q, int b)
	constant-time conditional swap of p,q when b==1
void	pc_x25519 (uint8_t out[32], const uint8_t scalar[32], const uint8_t point[32])
	X25519 scalar multiplication: out = scalar * point (RFC 7748 §5).
void	pc_x25519_base (uint8_t out[32], const uint8_t scalar[32])
	X25519 with the standard base point u=9: out = scalar * G.

Detailed Description

Curve25519 field arithmetic + X25519 (RFC 7748) for the curve25519-sha256 KEX.

Field elements are GF(2^255 - 19) in a portable radix-2^16 representation (sixteen int64 limbs), so no 128-bit integer type is needed - important because 32-bit xtensa (ESP32) gcc has no __int128. The same field arithmetic backs Ed25519 (pc_ed25519), so the field ops are exported here. Correctness is pinned to the RFC 7748 §5.2 test vectors (test_ed25519). No heap; all state is on the stack.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file curve25519.h.

Typedef Documentation

pc_gf

typedef int64_t pc_gf[16]

A field element of GF(2^255 - 19): 16 limbs, radix 2^16 (limb i weighs 2^(16i)).

Definition at line 25 of file curve25519.h.

Function Documentation

pc_gf_copy()

void pc_gf_copy	(	pc_gf	out,
		const pc_gf	in
	)

out = in

Definition at line 52 of file curve25519.cpp.

Referenced by pc_gf_pack().

pc_gf_add()

void pc_gf_add	(	pc_gf	out,
		const pc_gf	a,
		const pc_gf	b
	)

out = a + b (unreduced)

Definition at line 60 of file curve25519.cpp.

Referenced by pc_x25519().

pc_gf_sub()

void pc_gf_sub	(	pc_gf	out,
		const pc_gf	a,
		const pc_gf	b
	)

out = a - b (unreduced)

Definition at line 68 of file curve25519.cpp.

Referenced by pc_x25519().

pc_gf_mul()

void pc_gf_mul	(	pc_gf	out,
		const pc_gf	a,
		const pc_gf	b
	)

out = a * b mod p

Definition at line 188 of file curve25519.cpp.

Referenced by pc_gf_sq(), and pc_x25519().

pc_gf_sq()

void pc_gf_sq	(	pc_gf	out,
		const pc_gf	a
	)

out = a^2 mod p

Definition at line 221 of file curve25519.cpp.

References pc_gf_mul().

Referenced by pc_x25519().

pc_gf_inv()

void pc_gf_inv	(	pc_gf	out,
		const pc_gf	a
	)

out = a^-1 mod p (= a^(p-2))

Definition at line 260 of file curve25519.cpp.

References pc_gf_pack(), and pc_gf_unpack().

Referenced by pc_x25519().

pc_gf_pack()

void pc_gf_pack	(	uint8_t	out[32],
		const pc_gf	a
	)

canonical little-endian 32-byte encoding

Definition at line 317 of file curve25519.cpp.

References pc_gf_copy(), and pc_gf_cswap().

Referenced by pc_gf_inv(), and pc_x25519().

pc_gf_unpack()

void pc_gf_unpack	(	pc_gf	out,
		const uint8_t	in[32]
	)

decode 32 bytes (high bit ignored)

Definition at line 346 of file curve25519.cpp.

Referenced by pc_gf_inv(), and pc_x25519().

pc_gf_cswap()

void pc_gf_cswap	(	pc_gf	p,
		pc_gf	q,
		int	b
	)

constant-time conditional swap of p,q when b==1

Definition at line 304 of file curve25519.cpp.

Referenced by pc_gf_pack(), and pc_x25519().

pc_x25519()

void pc_x25519	(	uint8_t	out[32],
		const uint8_t	scalar[32],
		const uint8_t	point[32]
	)

X25519 scalar multiplication: out = scalar * point (RFC 7748 §5).

scalar and point are 32-byte little-endian; the scalar is clamped internally. out may alias neither input. Constant-time in the scalar (Montgomery ladder with conditional swaps).

Definition at line 434 of file curve25519.cpp.

References pc_gf_add(), pc_gf_cswap(), pc_gf_inv(), pc_gf_mul(), pc_gf_pack(), pc_gf_sq(), pc_gf_sub(), and pc_gf_unpack().

Referenced by pc_x25519_base(), and ssh_kexdh_handle().

pc_x25519_base()

void pc_x25519_base	(	uint8_t	out[32],
		const uint8_t	scalar[32]
	)

X25519 with the standard base point u=9: out = scalar * G.

Definition at line 494 of file curve25519.cpp.

References pc_x25519().

Referenced by ssh_kex_generate().