X25519 (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.math.ec.rfc7748

## Class X25519

- java.lang.Object
- - org.bouncycastle.math.ec.rfc7748.X25519

-     public abstract class X25519
      extends java.lang.Object

  A low-level implementation of X25519 (RFC 7748).

  Algorithm map.

  - `generatePrivateKey(java.security.SecureRandom, byte[])` — 32 random bytes followed by `clampPrivateKey(byte[])` (RFC 7748 sec. 5 clamping: clear bits 254..255 then 0..2, set bit 254).
  - `generatePublicKey(byte[], int, byte[], int)` / `scalarMultBase(byte[], int, byte[], int)` — computed as `k * B` on the birationally-equivalent `edwards25519` curve via `Ed25519#scalarMultBaseYZ(Friend, byte[], int, int[], int[])` (a signed multi-comb in extended Edwards coordinates), then converted to the curve25519 `u` coordinate using the RFC 7748 sec. 4.1 birational map `u = (1 + Y) / (1 - Y)` where `Y = y / z`.
  - `scalarMult(byte[], int, byte[], int, byte[], int)` (key agreement) — Montgomery ladder on XZ-only projective coordinates per RFC 7748 sec. 5, with per-bit constant-time `cswap`; the `A24 = (A + 2) / 4` curve constant is precomputed from `A = 486662`. The final three doublings correspond to the always-cleared low bits of the scalar; these clear the cofactor to ensure a non-twist result.
  - `calculateAgreement(byte[], int, byte[], int, byte[], int)` — `scalarMult(byte[], int, byte[], int, byte[], int)` followed by the RFC 7748 sec. 6.1 all-zero rejection.

  Side-channel scope. Secret-scalar operations are written to be constant-time at the Java level: the Montgomery ladder in `scalarMult(byte[], int, byte[], int, byte[], int)` performs identical field operations per bit with branchless `cswap`; `scalarMultBase(byte[], int, byte[], int)` routes through the Ed25519 signed-comb, which walks all precomputed entries with mask-based `cmov` rather than a secret-indexed array load and applies conditional negation by XOR-with-mask; the final modular inverse uses constant-time `Mod.modOddInverse`. The all-zero rejection in `calculateAgreement(byte[], int, byte[], int, byte[], int)` runs an OR-accumulator and only leaks the RFC-mandated public rejection criterion. This is sufficient against a remote network timing attacker but is not a substitute for a constant-time native implementation against a co-located cache-line-resolution adversary — JVM-level timing variance from JIT, GC and cache eviction is not addressable in pure Java.

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Class and Description
    --- | ---
    `static class` | `X25519.Friend`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static int` | `POINT_SIZE`
    `static int` | `SCALAR_SIZE`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `X25519()`

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static boolean` | `calculateAgreement(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)`
    `static void` | `clampPrivateKey(byte[] k)`
    `static void` | `generatePrivateKey(java.security.SecureRandom random, byte[] k)`
    `static void` | `generatePublicKey(byte[] k, int kOff, byte[] r, int rOff)`
    `static void` | `precompute()`
    `static void` | `scalarMult(byte[] k, int kOff, byte[] u, int uOff, byte[] r, int rOff)`
    `static void` | `scalarMultBase(byte[] k, int kOff, byte[] r, int rOff)`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### POINT_SIZE

          public static final int POINT_SIZE

      See Also:
        Constant Field Values

    - #### SCALAR_SIZE

          public static final int SCALAR_SIZE

      See Also:
        Constant Field Values

  - ### Constructor Detail

    - #### X25519

          public X25519()

  - ### Method Detail

    - #### calculateAgreement

          public static boolean calculateAgreement(byte[] k,
                                                   int kOff,
                                                   byte[] u,
                                                   int uOff,
                                                   byte[] r,
                                                   int rOff)

    - #### clampPrivateKey

          public static void clampPrivateKey(byte[] k)

    - #### generatePrivateKey

          public static void generatePrivateKey(java.security.SecureRandom random,
                                                byte[] k)

    - #### generatePublicKey

          public static void generatePublicKey(byte[] k,
                                               int kOff,
                                               byte[] r,
                                               int rOff)

    - #### precompute

          public static void precompute()

    - #### scalarMult

          public static void scalarMult(byte[] k,
                                        int kOff,
                                        byte[] u,
                                        int uOff,
                                        byte[] r,
                                        int rOff)

    - #### scalarMultBase

          public static void scalarMultBase(byte[] k,
                                            int kOff,
                                            byte[] r,
                                            int rOff)