Both parties uses Curve 25519 key pairs for ECDH key exchange. What is the key length of shared secret after ECDH?

  • $\begingroup$ Hint: Of what type is a DH shared secret usually? How big is that type for Curve25519? $\endgroup$
    – SEJPM
    Commented May 11, 2020 at 9:19
  • $\begingroup$ @SEJPM: the standard 32-byte curve25519 for ecdh $\endgroup$
    – TJCLK
    Commented May 11, 2020 at 9:29

1 Answer 1


In this paper you can find nearly everything about Curve25519. In the section "Specification" you find the answer:

{Curve25519 secret keys} × {Curve25519 public keys} → {Curve25519 public keys}

this is the function, which is calculated for a key exchange. So the shared secret key has the same properties as the public keys:

{ $q: q \in ${ $0,1,...,2^{256 - 1}$}}

This matches, what Bernstein says in the introduction: The key length (for both public and private) are 32 byte long. And in that format they are stored. In other words every key is 256 bits long.

In this post you see an example for these keys.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.