Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can curve25519 keys be used with ed25519?

I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.

At the very least can the curve25519 keys be restricted if some can be converted ed25519?

share|improve this question
The problem is that you don't get the y part of the coordinate when using a montgomery ladder to compute the public key. – CodesInChaos Jan 22 '14 at 20:26
This question appears to be off-topic since it turns out it’s more about asking for reference recommendations regarding Java libraries/implementations, instead of cryptography as defined in the help center. The fact that answers point to different libraries underlines this. Note: asking for reference recommendations related to libraries (including crypto-libs) are on-topic at SoftwareRecommendations.SE – e-sushi Aug 4 '14 at 4:02
up vote 5 down vote accepted

Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives.

To convert a Curve25519 public key $x_C$ into an Ed25519 public key $y_E$, with a Ed25519 sign bit of $0$: $$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$ The Ed25519 private key may need to be adjusted to match the sign bit of $0$: if multiplying the Curve25519 private key by the Ed25519 base point yields a “negative” Ed25519 x-coordinate, then the private key must be negated modulo the order of the base point: $a_E = q - a_C$.

See Trevor Perrin's email and the ensuing thread for a security analysis.

share|improve this answer

AFAIK, no. However, Ed25519 keys can be converted to Curve25519 keys. My Ed25519 library supports this (or well, it supports DH with Ed25519 keys).

Whether it is secure to use the same key for both signing and Diffie-Hellman, I don't exactly know. This answer suggests that it is very likely, but it still needs more study.

share|improve this answer
Thank you nightcracker! I think I either have to use Curve25519 at this point or another digital signature algorithm unless if you can help with this. Thank you so very very much in advance!… – user7024 Jan 22 '14 at 20:42
@Gracchus I think you should look into using a C library from Java - there are almost no cryptographers writing libraries in Java. – orlp Jan 22 '14 at 21:08
Thank you nightcracker! I've noticed. ;)) I do appreciate your help! – user7024 Jan 22 '14 at 21:33
@nightcracker Come again? Sun JCE, PKCS11 & JSSE + ECC. Then there are Bouncy Castle, IAIK libraries, BSAFE... If you want support for a specific curve, ask on the Bouncy mailing list! Or add it yourself of course! – Maarten Bodewes Jan 23 '14 at 15:21
@owlstead Sorry, I meant the cryptographers that develop the primitives themselves - they almost never release a Java library. There are a few "cryptography suites" as you've cited, that implement many primitives, but outside of those big suites there isn't much high-quality Java cryptography software available. This means that if you want to use modern cryptography, like Ed/Curve25519, ChaCha, Keccak, BLAKE, Poly1305, that you'll either have to implement it yourself or trust an often badly performing non-scrutinized third-party implementation. – orlp Jan 24 '14 at 8:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.