I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is given below:

HTTPS Connection Information

The first states ECDHE_ECDSA with X25519 as the key exchange. The second just states plainly that X25519 is the key exchange. This seems odd to me because X25519 is the curve, correct? Are these two key exchanges the same and they are just worded differently (for some reason)? Is this because of the use of QUIC? The first site is an API, the second is google.co.nz.

What are the differences, if any?


There is no difference. It’s just the way the devs described it; which actually makes sense because X25519 implies ECDH is used.

Also, X25519 is not the curve… it’s the function (to be used with Curve25519).

Quoting RFC 7748, Elliptic Curves for Security, January 2016, Page 7:

The "X25519" and "X448" functions perform scalar multiplication on the Montgomery form of the above curves. (This is used when implementing Diffie-Hellman.)

So, to recap: The curves are named Curve25519 and Curve448, while the according functions are called X25519 and X448. And since X25519 implies ECDH, one might regard the additional mentioning of ECDH or ECDHE_ECDSA to be superfluous.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.