# Why is Curve25519 mostly used for key exchange?

When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema. I know, that Curve25519 has a pretty fast arithmetic, so my first idea was, that it is used to decrease the server load. Am i right with my idea? Can someone give me a better answer?

Edit: I understand that my question may be not clear enough: Why is it not used for encryption/decryption of messages, when used in messenger like Threema?

• Side-channel resistance due to the Montgomery ladder? Mar 27 '20 at 11:58
• That still does not answer the question, y it is not used for the encryption itself. Mar 27 '20 at 12:02
• What would you expect the curve to be used for? Mar 27 '20 at 12:11
• Encryption and Decryption, too. I know, that there is Elgamal on short Weierstraß equations, so i thought is would be able to use it on Curve25519 too. Mar 27 '20 at 12:15
• Have you ever heard hybrid Cryptosystem, and do you know that embedding plaintext is not perfect in ECC? Mar 27 '20 at 12:32

A number of reasons contribute to this.

Curve25519 has a non-governmental origin.

It's a curve that's very safe by design, and impregnable to many side-channel and other weaknesses that other curves suffer from.

Also, it's a curve with 'nothing up my sleeve' coefficients.

Unlike the NSA curves, which NIST endorse.

Although not directly related, after the backdoor in Dual_EC_DRBG had been exposed, suspicious aspects of the NIST's P curve constants led to concerns that the NSA had chosen values that gave them an advantage in finding private keys. Since then, many protocols and programs started to use Curve25519 as an alternative to NIST P-256 curve.

As Kelalaka states, the constant time scalar multiplication provided by the Montgomery ladder is also pretty cool.

You cannot directly encrypt arbitrary amounts of data direct with elliptic curves.

The public key is a point on the curve and the private key is a number.

There isn't an elegant mechanism to directly encrypt (generalised ElGamal notwithstanding).

That's why key agreement revolves around finding a shared point on the curve and using a digest of the x co-ordinate of that shared point to use with a fast, secure symmetric cipher.

• @Titanlord, updated my answer Mar 27 '20 at 12:35
• "Curve25519 has quite a 'cipher-punk' origin." Probably should be removed. Or describe the origin in less vague terms. Some people see "cypherpunk" with positive connotations (activists and advocates). Others have negative connotations (sloppy coding, foot dragging when warned about vulnerabilities, amateur hubris, mailing list people). Curve25519's technical merits are really impressive. I don't think it's origin amounts to much compared to those merits. It's plausible, too, that the origin could have slowed its initial adoption. Mar 28 '20 at 23:37
• (I don't have an opinion about what cypherpunk means. I bet that if you had a debate over the meaning with a large enough group of people, then you'd almost immediately enter no-true-Scotsman territory and not get anywhere. DJB is a pretty great activist and algorithm designer, though, regardless of whether he's considered cypherpunk or who else is considered cypherpunk.) Mar 28 '20 at 23:46
• Agreed and updated. Mar 29 '20 at 13:43

In general, asymmetric cryptography (which includes elliptic curve crypto, RSA, Diffie-Hellman, etc) is orders of magnitude slower than symmetric cryptography (e.g., AES). Curve 25519 is fast compared to other asymmetric cryptography, but still very slow compared to symmetric encryption.

Because of this, asymmetric cryptography is mostly used to set up symmetric keys for further use in symmetric cryptography (key exchange, hybrid encryption, etc), or for electronic signatures (where it is applied to a hash of a document/message, and not the full document/message, for the same inefficiency reason).

Thus you expect asymmetric cryptography (and as a side effect, Curve 25519) in contexts such as:

The list is far from exhaustive, but should give you an idea where to look.

So I think that the question to your answer is that it is not specific to Curve 25519 at all -- you could probably observe the same for any asymmetric cryptographic scheme: messages are likely to be encrypted using a symmetric cipher such as AES for efficiency, and the key for that is set up using key exchange or inside the hybrid encryption, for which Curve 25519 might be used.

• Is message expansion in general a disadvantage of assymetric system, too? Mar 28 '20 at 9:32
• I think this is a minor issue compared to the other points. It depends a lot on the exact properties you want. Mar 28 '20 at 16:25