x25519

nimony/lib/std/crypto/x25519.nim

X25519 Diffie-Hellman (RFC 7748).

The field is GF(2^255 - 19) in sixteen 16-bit limbs held in int64s, after TweetNaCl: every product fits, carries are arithmetic shifts, and the Montgomery ladder swaps with a mask. Nothing branches on or indexes by a secret, so the scalar does not leak through timing.

type X25519Key = array[0..31, uint8]
const BasePoint: array[0..31, uint8]
func x25519(scalar: array[0..31, uint8]; point: array[0..31, uint8]): array[0..31, uint8]
scalar * point on Curve25519: the shared secret when point is the peer's public key, the public key when it is BasePoint.
func x25519Public(secret: array[0..31, uint8]): array[0..31, uint8]
func isAllZero(k: array[0..31, uint8]): bool
RFC 7748 §6.1: a peer that sends a small-order point makes the shared secret all zeros. Checked without an early exit.