Difference between X25519 and Ed25519 - Cryptography Stack Exchange
Stack Exchange Q&A explaining how X25519 (ECDH key exchange) and Ed25519 (EdDSA signatures) both build on Curve25519 using different curve forms and coordinate representations.
Overview
This Cryptography Stack Exchange question and its answers clarify a common source of confusion: X25519 and Ed25519 share the same underlying elliptic curve (Curve25519, due to Daniel J. Bernstein) but serve entirely different purposes. X25519 is an elliptic-curve Diffie-Hellman (ECDH) key-exchange function, while Ed25519 is a digital-signature scheme (an instance of EdDSA). The discussion explains why the same curve appears under two names and what the “X” and “Ed” prefixes mean.
Key points
- Both primitives derive from Curve25519, a specific elliptic curve offering roughly 128-bit security, chosen for speed, safe parameters, and resistance to implementation pitfalls.
- X25519 (specified in RFC 7748) performs Diffie-Hellman key agreement over the Montgomery form of the curve, using only the x-coordinate via the Montgomery ladder. The “X” refers to that x-coordinate-only computation.
- Ed25519 (specified in RFC 8032) is the EdDSA signature scheme over edwards25519, a twisted Edwards curve. The “Ed” refers to the Edwards curve form.
- The Montgomery and twisted Edwards representations are birationally equivalent: they describe essentially the same curve in different coordinate systems, which is why one curve underpins both functions.
- The two schemes are not drop-in interchangeable: key exchange and signing are distinct operations. Deterministic maps exist to convert between Ed25519 and X25519 keys, but reusing one key pair for both purposes is generally discouraged.
- Both see wide real-world deployment, for example X25519 for key exchange in TLS 1.3 and Ed25519 for signatures in SSH, TLS certificates, and other protocols.
Relevance to Truestamp
Truestamp uses Ed25519 signatures to sign blocks and proof data, so understanding that Ed25519 is a signature scheme (distinct from the X25519 key-exchange function that shares the same curve) is directly relevant. See Ed25519 signatures.
Citations
- Difference between X25519 and Ed25519 - Cryptography Stack Exchange. Community question and answers on the Cryptography Stack Exchange.