Does anybody know a point-matching function for curve 25519? Or has a straight-forward way how to derive any arbitrary point-matching function?

It should be like a reversible mapping from and to a 128+ bit number to and from points on the Curve 25519.

The aim is actually to have the point being on the edwards form of the curve.


1 Answer 1


This is what Elligator was designed for.

Specifically, the Elligator 2 is suitable for Curve25519 which maps a 32 bytes integer to a point on the curve.

As for implementations of this map:

  • libsodium: the implemented function maps a $32$ bytes vector to a point that belongs on the prime order subgroup on the Edwards form of Curve25519, by multiplying by the curve cofactor; but not the inverse map;
  • Monocypher implements the map and its inverse, but the points seem to be on the Montgomery form so it might be needed to convert the points to the Edwards form if necessary, and additional code in Python is present for Edwards form of Curve25519;
  • C implementation of elligator 2: words for Curve25519.

For information, there is a version made for prime order curves in Weierstrass form called Elligator squared.

Thanks to xorhash for additional links.

  • 2
    $\begingroup$ Note that libsodium only implements the map from uniform bytes to curve. The inverse map (curve to bytes), which OP also asked for, is not implemented by libsodium. Monocypher implements it, but only for Montgomery Curve25519; tests/gen has Python code for Edwards as well. There is also github.com/Kleshni/Elligator-2. $\endgroup$
    – xorhash
    Aug 16, 2020 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.