Things that use Curve25519

Updated: April 18, 2024

Here's a list of protocols and software that use or support the superfast, super secure Curve25519 ECDH function from Dan Bernstein. Note that Curve25519 ECDH should be referred to as X25519.

This page is organized by Protocols, Networks, Operating Systems, Hardware, Software, SSH Software, WireGuard Software, TLS Libraries, NaCl Crypto Libraries, lib25519, LibHydrogen, Libraries, Miscellaneous, Timeline notes, and Support coming soon.

You may also be interested in this list of Ed25519 deployment.

Protocols

• DNS
  • DNSCurve — encrypted DNS between a resolver and authoritative server
  • DNSCrypt — encrypted DNS between a client and a resolver
• Transport (loosely defined)
  • TLS — TLS
  • CurveCP — a secure transport protocol
  • QUIC — a secure transport protocol
  • Noise — a framework for crypto protocols based on Diffie-Hellman key agreement
  • CurveZMQ — Security for ZeroMQ
  • Nitro — a very fast, flexible, high-level network communication library
  • Dust — A Polymorphic Engine for Filtering-Resistant Transport Protocols
  • RAET — Reliable Asynchronous Event Transport Protocol
  • Evernym — a high-speed, privacy-enhancing, distributed public ledger engineered for self-sovereign identity
  • SSH, thanks to the curve25519-sha256@libssh.org key exchange from the libssh team, adopted by OpenSSH and TinySSH
• Other
  • WireGuard — fast, modern, secure VPN tunnel
  • saltpack — a modern crypto messaging format
  • obfs4 — a look-like nothing obfuscation protocol
  • Riffle — an efficient communication system with strong anonymity
  • S/MIME 4.0 — Secure/Multipurpose Internet Mail Extensions
  • Chain Key Derivation — a deterministic key derivation scheme
  • OMEMO — an XMPP Extension Protocol (XEP) for secure multi-client end-to-end encryption
  • (n+1)sec — a free, end-to-end secure, synchronous protocol for group chat
• IPsec
  • OpenIKED — IKEv2 daemon which supports non-standard Curve25519
• ZRTP
  • ZRTPCPP — GNU ZRTP C++
• Other
  • Signal Protocol — encrypted messaging protocol derivative of OTR Messaging
  • Pond — forward secure, asynchronous messaging for the discerning ^{project in stasis}
  • ZeroTier — Create flat virtual Ethernet networks of almost unlimited size
  • telehash — encrypted mesh protocol
  • Olm — A Cryptographic Ratchet
  • Apple AirPlay — stream content to HDTV/speakers

Networks

• Tor — The Onion Router anonymity network
• GNUnet — a framework for secure peer-to-peer networking that does not use any centralized or otherwise trusted services
• URC — an IRC style, private, security aware, open source project
• Serval — Mesh telecommunications
• Nebula — open source global overlay network from Slack
• Yggdrasil — a fully end-to-end encrypted network
• Peergos — An end-to-end encrypted, peer-to-peer file storage, sharing and communication network
• SAFE — A new Secure way to access a world of existing apps where the security of your data is put above all else
• Stellar (Payment Network) — low-cost, real-time transactions on a distributed ledger
• cjdns — encrypted ipv6 mesh networking

Operating Systems

• OpenBSD — used in OpenSSH, LibreSSL, OpenIKED, CVS over SSH, and WireGuard
• Apple iOS — used in the iPhone, iPad, and iPod Touch
• Android — ships with Chrome, which supports X25519 for TLS and QUIC
• macOS — used in multiple places
• Linux — kernel 5.6 (or later) supports WireGuard
• FreeBSD 13.2 supports WireGuard
• Windows — used in OpenSSH, Microsoft Edge, and maybe others
• OPNsense — an open source, easy-to-use and easy-to-build HardenedBSD based firewall and routing platform
• All operating systems that ship with OpenSSL 1.1.0+
• All operating systems that ship with LibreSSL from the OpenBSD Project
• All operating systems that ship with OpenSSH from the OpenBSD Project

Hardware

• Nitrokey Start — encrypts your emails, files, and server access
• SC4 HSM — a fully-open USB2 HSM (hardware-secure module)
• CEC1702 — ARM Cortex M4-based microcontroller with a complete hardware cryptography-enabled solution in a single package
• Librem 5 — the first Matrix-powered smartphone, in the dialer and messaging app
• Hardware-Accelerated-SigmaVPN — a VPN device design project using a Zybo Board and ZYNQ fpga

Software

• DNS
  • CurveDNS — a DNSCurve Forwarding Authoritative Name Server ^{also on github}
  • djbdns dnscurve patch — adds DNSCurve support to dnscache
  • dqcache — Recursive DNS/DNSCurve server ^{also on github}
  • dq — a command-line tool to debug DNS/DNScurve
  • pymdscurve & dnspythoncurve — python authoritative server & recursive resolver
  • Unbound — a validating, recursive, and caching DNS resolver
  • dnscrypt-proxy — securing communications between a client and a DNS resolver
  • dnscrypt-wrapper — add dnscrypt support to any name resolver
  • SimpleDnsCrypt — A simple management tool for dnscrypt-proxy
  • dnscrypt-win-client — DNSCrypt for Windows (OpenDNS front-end to dnscrypt-proxy)
  • dnscrypt-win-client — DNSCrypt for Windows (Noxwizard front-end to dnscrypt-proxy)
  • dnscrypt-osxclient — Mac OSX application to control the DNSCrypt Proxy
  • dnscrypt — authenticated and encrypted DNS client for nodejs
  • dnscrypt-proxy-gui — Qt/KF5 GUI wrapped over dnscrypt-proxy
  • DNSCryptClient — A simple DNSCrypt client
  • dnsdist — a highly DNS-, DoS- and abuse-aware loadbalancer (supports DNSCrypt)
• Web browsers, crawlers and other clients
  • Google Chrome
  • Firefox
  • Safari
  • Iridium — Chrome with privacy enhancements
  • Microsoft Edge
  • Let's Encrypt validation server
  • Googlebot — Google's web crawler
• Web Servers
  • Caddy — supports X25519 in TLS and QUIC
  • Microsoft IIS 10+
  • All webservers built with LibreSSL (OpenBSD and others)
  • All webservers built with OpenSSL 1.1.0+ (Debian 9, FreeBSD 12+, etc.)
• Password managers
  • keepassxc-browser — Chrome extension for KeePassXC with Native Messaging
  • passgo — Simple golang password manager
  • kbs2 — A secret manager backed by age
  • gopass — the team password manager
• CurveCP related
  • CurveProtect — securing major protocols with CurveCP. Also supports DNSCurve.
  • qremote — an experimental drop-in replacement for qmail's qmail-remote with CurveCP support
  • curvevpn — based on CurveCP
  • spiral-swarm — easy local file transfer with curvecp [ author recommends another project ]
  • QuickTun — "probably the simplest VPN tunnel software ever"
  • frereth-cp — CurveCP implemented in clojure
  • jeremywohl-curvecp — "A Go CurveCP implementation I was sandboxing; non-functional."
  • curvecp — CurveCP programs, linked with TweetNaCl and built statically with Musl libc
  • curvecp.go — Go implementation of the CurveCP protocol
  • curvecp — Automatically exported from code.google.com/p/curvecp
  • urcd — the most private, secure, open source, "Internet Relay Chat" style chat network
• MinimaLT related (all Pre-Alpha, not production ready, please contribute!)
  • The MinimaLT authors will soon release beta code. But some people are so excited about the protocol that they've written approximations based on published descriptions of it. Since I'm excited about MinimaLT as well, and since it shows serious public interest, I'm listing the following here.
  • MinimaLT-experimental — an approximation of the MinimaLT protocol, in javascript
  • safeweb — Proposition of a faster and more secure Web (MinimaLT + DNSNMC)
• Messaging Software
  • Signal — secure text messaging (previously known as TextSecure)
  • WhatsApp — mobile messaging app for iPhone, BlackBerry, Android, Windows Phone and Nokia
  • Riot/Matrix — end-to-end encrypted messaging
  • Vuvuzela — a private chat application that hides metadata, including who you chat with and when you are chatting
  • signal-cli — a commandline and dbus interface for WhisperSystems/libsignal-service-java
  • Wire — encrypted private messaging
  • xocolatl — Trevor's & Moxie's Axolotl Ratchet + AGL's xmpp-client
  • SafeSwiss — private messaging from Switzerland
  • Facebook Messenger — although security is disabled by default
  • MicroMinion platform — a secure messaging layer with end-to-end connectivity using a variety of underlying transport mechanisms
  • SignalServiceKit — a boilerplate for Mac & iOS apps
  • textsecure-go — TextSecure client package for Go
  • Rival Messenger — Secure Decentralized Communication Built on Telehash
  • CrossClave — zero-knowledge messaging and file transfer
  • Signal-Windows — an unofficial Signal client for the Universal Windows Platform
  • mute — secure messaging
  • zkc — Zero Knowledge Communications
  • Silence — A fork of Signal with only SMS/MMS encryption
  • NanoChat — A P2P, E2E encrypted and discoverable chat application on top of nanomsg library
  • shadowfax — a simple, lightweight confidential messaging system
  • Threema — encrypted messaging app (closed source)
  • scomms — Secure Communications - One size, fits all crypto messaging tool
  • chatterbox — A chat thingy
  • Cyph — a secure communication tool designed to be extremely friendly for users of any technical skill level
  • TarsierMessenger — Tarsier Messenger is a messaging application using WiFi direct
  • Sid — secure messaging and file transfer
  • Viber — Free calls, text and picture sharing with anyone, anywhere
  • cha-cha-chat — Example of ChaCha20 encrypted chat with ECDH key exchange
  • zkm — Zero Knowledge Messaging
  • axolotl-sample-client — example of how to NuGet reference libaxolotl and curve25519 for crypto use
  • opake — Messaging with in-browser encryption using curve25519
• Tox Software
  • Tox — Free, secure, Skype alternative
  • toxcore — an easy to use, all-in-one communication platform
  • uTox — Lightweight Tox client
  • qTox — Powerful Tox client that follows the Tox design guidelines
  • Toxy — Metro-style tox client for Windows
  • tox4go — just a collection of tools for Tox written in Go
  • WinTox — Tox port to Visual Studio
  • OneTox — Tox client for the Universal Windows Platform
  • tox-irc-sync — A bot that sync messages between Freenode IRC #tox-dev and Tox group chat
  • toxcore-vs — All necessary libs to build static toxcore using Visual Studio 2013
  • toxic — An ncurses-based Tox client
• Other VPN and tunneling software
  • OpenIKED — IKEv2 daemon for IPsec, from the OpenBSD project
  • Libreswan — an IPsec implementation for Linux
  • curvetun — a lightweight curve25519-based IP tunnel
  • titun — Simple, fast, and cross-platform IP tunnel written in Rust. WireGuard compatible
  • strongSwan — open source IPsec-based VPN
  • sigmavpn — Light-weight, secure and modular VPN solution
  • fastd — Fast and Secure Tunneling Daemon
  • GoVPN — DPI/censorship-resistant, written on Go

SSH Software

• SSH software with full modern crypto support (sntrup761x25519-sha512@openssh.com, X25519, Ed25519 and ChaCha20-Poly1305)
  • OpenSSH — Secure Shell from the OpenBSD project
  • TinySSH — a small SSH server with state-of-the-art cryptography
• SSH software with full classic crypto support, lacking post-quantum security
  • Win32-OpenSSH — Win32 port of OpenSSH
  • PuTTY — a free implementation of SSH and Telnet for Windows and Unix platforms
  • KiTTY — a fork from version 0.70 of PuTTY with extra features
  • Dropbear — an SSH server and client
  • WinSCP — a popular SFTP client for Microsoft Windows
  • SecureCRT — SSH client for Windows, Mac, and Linux
  • asyncssh — an asynchronous SSH2 client and server atop asyncio
  • Termius — an SSH client that works on Desktop and Mobile
  • rlogin — Japanese rlogin, telnet, and ssh client
  • pssht — SSH server written in PHP
• SSH software with partial modern crypto support (at least x25519)
  • ConnectBot — SSH client for Android
  • redox-ssh — SSH Client and Server written in Rust
  • SmartFTP — an FTP, SSH, SFTP client
  • pts-dropbear — Dropbear SSH tools with ed25519 and other improvements by pts
  • SwiftNIO SSH — SSH in Swift
  • Cyberduck — a libre FTP, SFTP, WebDAV, S3, Backblaze B2, Azure & OpenStack Swift browser for Mac and Windows
  • net-ssh — pure-Ruby implementation of the SSH2 client protocol
  • TinyTERM (proprietary; support according to this comparison page)
    • TinyTERM for Android
    • TinyTERM for iOS
  • Tera Term — SSH client for Windows

WireGuard Software

Note: please see this WireGuard software list for more tools and things in the WireGuard ecosystem.

• WireGuard — an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography
• Android: WireGuard/Android
• FreeBSD: included in release 13.2 and later
• Go: wireguard-go
• iOS: WireGuard/iOS
• Linux: included in kernel 5.6 and later; backport modules available
• macOS: WireGuard/macOS
• NetBSD: included in release 10.0 and later; please note that Jason Donenfeld in 2020 stated that this code " simply is not a WireGuard implementation" and I don't know what has changed since then. NetBSD users may consider using the Golang userspace implementation.
• OpenBSD: included in release 6.8 and later
• Rust: wireguard-rs
• Windows: WireGuard/Windows
  • Browse Windows MSIs
• Apple developers: WireGuardKit — Swift PM package for easily building macOS/iOS apps that use WireGuard tunnels
• 3rd party: TunSafe — Experimental WireGuard Client for OSX (3rd party)
• 3rd party: WireSep — userspace WireGuard for OpenBSD with privsep and tight pledge(2) (3rd party)
• 3rd party: BoringTun — a userspace WireGuard implementation in Rust (3rd party)

Other Software

• Tor — The Onion Router
• age — an encryption tool with small keys, no config options, and UNIX-style composability
• rage — Rust implementation of age
• GlobaLeaks — The Open-Source Whistleblowing Software
• reop — reasonable expectation of privacy
• tweetnacl-tools — Tools for using TweetNaCl
• arti — an implementation of Tor, in Rust
• haskell-tor — A Haskell implementation of the Tor protocol
• torch — Probably not the Tor client you are looking for
• FalconGate — A smart gateway to stop hackers and Malware attacks (includes DNSCrypt support)
• rdedup — Data deduplication with compression and public key encryption
• SaltStack — automation for CloudOps, ITOps and DevOps at scale (uses ZeroMQ for transport)
• pbp — salty privacy (provides basic functionality resembling PGP)
• Qabel — a free, published-source cryptography platform
• salty — A practical, compact CLI crypto system based on TweetNaCl, featuring public key sharing and zero-password peer stream encryption
• vcrypt — Toolkit for multi-factor, multi-role encryption
• TREES — a plugin that adds individually encrypted mail storage to the Dovecot IMAP server
• CoCSharp — Clash of Clans library, proxy and server written in .NET
• quic-go — A QUIC server implementation in pure go
• urcd — URC Server
• oppy — A Tor client (onion proxy) implementation in Python
• DoorKeeper — An attempt to enable secure communication, authentication & authorization for my ESP8266 project
• KinomaJS — A JavaScript runtime optimized for the applications that power IoT devices
• tbak — Encrypted, compressed, distributed backups
• detox-crypto — High-level utilities that combine under simple interfaces complexity of the cryptographic layer used in Detox project
• zax — NaCl-based Cryptographic Relay
• virgil-cli — tool to encrypt, decrypt, sign and verify any input, and key management using Virgil Keys
• rdedup — Data deduplication engine, supporting optional compression and public key encryption
• srlog2 — Secure Remote Log Transmission System
• Secrete — ECIES implementation with Curve25519
• wireproxy — Wireguard client that exposes itself as a socks5 proxy
• Scuttlebot — a peer-to-peer log store used as a database, identity provider, and messaging system
• OpenSSL-x25519-key_exchange — Example of key generation and shared secrets using OpenSSL and x25519
• srndv2 — some random news daemon (version 2)
• encryptify — encryptify encrypts files
• clmm — An exercise in cryptographic minimlism
• mini-tor — proof-of-concept implementation of tor protocol using Microsoft CNG/CryptoAPI
• session-keys-rb — deterministic generation of unique UIDs and NaCl crypto keys from a username and high entropy passphrase
• pearl — Tor relay implementation in Golang
• fritz — a Gui to de-/encrypt messages or files using nacl-crypto
• sodium11 — A command line toolkit for encryption and signing of files based on libsodium
• Steganography — a file crypto which uses steganography to hide data in PNG files
• vindicat — Mesh networking based on maintaining a graph of link objects signed by peers (WIP)
• cordova-plugin-minisodium — A minimal cordova plugin that provides a binding to libsodium
• locker — easy secure locker
• lockbox — Simplified Asymmetric Encryption with NaCl
• steady — A simple end-to-end secure logging system
• zvault — Deduplicating backup solution
• tlsfuzzer — SSL and TLS protocol test suite and fuzzer
• pgsodium — Postgres extension wrapper around libsodium
• FrankerFaceZ — The Twitch Enhancement Suite
• pipesocks — A pipe-like SOCKS5 tunnel system
• freedom-portacrypt — Passphrase based asymmetric crypto using scrypt and NaCl
• gajim-omemo — Gajim plugin for OMEMO Multi-End Message and Object Encryption
• SC4 — Strong Crypto for Mere Mortals
• gobox — Trivial CLI wrapper around go.crypto/nacl/box
• SodiumUE4 — An easy to use cryptography plugin for Unreal Engine 4 based on libsodium
• quantum — A lightweight, encrypted, WAN oriented, software defined network device
• EDHOC-C — Ephemeral Diffie-Hellman Over COSE (EDHOC)
• Android-Sqrl2 — Android implementation of a full featured SQRL client
• mysql-sodium — Mysql UDF bindings for LibSodium
• qabel-core — Implementation of Qabel-Core in Java
• Rubinius Language Platform — a modern language platform that supports a number of programming languages
• servertail — quickly and easily see real time output of log files on your servers
• cryptomirror — explores ways to make crypto user-friendly in non-crypto friendly environments
• couch-box — Asymmetric encrypted CouchDB documents, powered by NaCl's curve25519-xsalsa20-poly1305
• cubed_old — A proper open-source minecraft clone in C++
• SQRL — Secure Quick Reliable Login
• dOTP — Decentralized One Time Passwords
• box — Simple file authenticated encryption/decryption
• usermgr — a tool to turn access to production systems from a pain in the butt into ponies and rainbows
• nacl-selective-keygen — Generate a NaCl keypair where the public key matches a certain pattern
• cryptapult — Encrypt things off your Key ASIC dongle
• secfileshare — Securely share files with others
• curve-keygen — a utility to generate Curve25519 keypairs
• confidential-publishing — Code for "A decentralized approach to publish confidential data"
• cryptutils — Various crypto utilties based on a common NaCl/Ed25519 core
• acceptable-security-otr — experiments in OTR stuff, PURELY for educational purposes
• RChain Cooperative — a consesus algorithm using a proof-of-stake protocol
• cacophony — Pipes for Noise-secured network connections
• scrambl.is — a small web page allowing the easy composition and reading of encrypted messages
• gr-nacl — GNU Radio module for data encryption using NaCl library
• up — sending a file from one computer to another using the nacl library
• cloak — A simple passphrase based file encryption tool
• quicbench — HTTP/QUIC load test and benchmark tool
• session25519 — Derive curve25519 key pair from email/password via scrypt
• pcp — Pretty Curved Privacy
• wot-crypto — Crypto utils for node-wot using libsodium
• CurvedSalsa — encrypt/decrypt files with Salsa20 & Curve25519
• Vanadium — create mobile and distributed applications that work even without an Internet connection
• Enchive — encrypted personal archives
• session-keys-js — A cryptographic tool for the deterministic generation of unique user IDs, and NaCl cryptographic keys
• RNP — a set of OpenPGP (RFC4880) tools that works on Linux, *BSD and macOS as a replacement for GnuPG
• Curve25519-AES — A simple program to test an idea I had, probably terrible
• asignify — Yet another signify tool
• nymphemeral — an ephemeral nymserver GUI client
• hs-noise — encrypted networking in Haskell
• cordova-plugin-curve25519 — Curve25519 plugin for Cordova/Phonegap - for iOS and Android
• aenker — authenticated encryption on the commandline using a chunked construction similar to intermaclib
• Key 2.0 — a Bluetooth IoT Door Lock
• CPGB — Curve Privacy Guard B, a secure replacement for GPG using ECC
• Simply Good Privacy — PGP-like system without web of trust
• PoSH-Sodium — Powershell module to wrap libsodium-net methods
• Kryptor — open source file encryption software for Windows, Linux, and macOS
• tweetsodium — implements libsodium's sealed boxes using the tweetnacl-js and blakejs libraries
• midgetpack — a multiplatform secure ELF packer
• Mesh — A tool for building distributed applications
• Osteria — secure point-to-point messenger
• mcrypt — Message Crypto - Encrypt and sign individual messages
• chdkripto — CHDK firmware - crypto modules (work in progress)
• vtun-jedisct1 — A mirror of VTUN, with some changes
• srndv2 — some random news daemon (version 2)
• pyaxo — A python implementation of the Axolotl ratchet protocol
• crypto-bench — Benchmarks for crypto libraries (in Rust, or with Rust bindings)
• SUPERCOP — a cryptographic benchmarking suite

Signal Protocol Libraries

• SignalProtocolKit — an implementation of the Signal Protocol, written in Objective-C
• libsignal-protocol-java — Signal Protocol library for Java/Android
• libsignal-protocol-c — Signal Protocol C Library
  • SignalProtocol-ObjC — Unofficial Objective-C wrapper for libsignal-protocol-c
• libsignal-protocol-javascript — Signal Protocol library for JavaScript
  • signal-protocol — fork that supports node.js and the browser
• libsignal-service-java — A Java/Android library for communicating with the Signal messaging service

TLS Libraries

• LibreSSL
• Go crypto/tls
• BoringSSL
• GnuTLS
• rustls
• OpenSSL 1.1.0+
• wolfSSL — a lightweight SSL/TLS library in ANSI C for embedded, RTOS, and resource-constrained environments
• TabbySSL — an OpenSSL compatibility layer for the Rust SSL/TLS stack
• Botan
• tlslite-ng — an open source python library that implements SSL and TLS cryptographic protocols
• BearSSL
• mbed TLS — open source library formerly known as PolarSSL
• NSS
• Leto — A managed TLS library without all the baggage
• tlspin — TLS without PKI
• Inside Secure TLS Toolkit (formerly known as MatrixSSL) — TLS in C with minimalistic system dependencies
• miTLS — A verified reference implementation of TLS
• fizz — C++14 implementation of the TLS-1.3 standard, by Facebook
• TLSe — Single C file TLS 1.3, 1.2, 1.1 and 1.0 implementation, using libtomcrypt as crypto library
• Picotls — a TLS 1.3 implementation written in C
• VbAsyncSocket — Sockets with pure VB6 impl of TLS encryption
• Java 11+ — programming language
• BoarSSL
• Others coming soon, which is next?!

NaCl Crypto Libraries

For cryptographic libraries in the NaCl family, including NaCl itself, TweetNaCl, uNaCl, and libsodium, as well as wrappers, bindings, and ports.

• NaCl + wrappers & bindings
  • NaCl — Networking and Cryptography Library (Core team: Daniel J. Bernstein, Tanja Lange, and Peter Schwabe)
  • salt — Haskell bindings for NaCl
  • node-nacl — Node.js bindings for NaCl
  • node-djb-nacl — Node.js bindings for NaCl
  • PyNaCl — a python wrapper for NaCl
  • qsalt — NaCl bindings for Q/KDB
  • racl — Racket bindings for nacl.cr.yp.to
  • ruby-nacl — a Ruby wrapper for NaCl
• NaCl ports etc.
  • C#: Chaos.NaCl — a cryptography library written in C#, based on NaCl
  • Go: golang.org/x/crypto/nacl — NaCl package for Go
    • kevinburke-nacl — Pure Go implementation of the NaCl set of APIs
  • Javascript: ecma-nacl — JavaScript version of NaCl Cryptographic library
  • Python: slownacl — a pure Python implementation of the NaCl Python API
  • Rust: nacl-compat — Pure Rust compatibility layer for NaCl-family libraries
  • Scala: nacl4s — Scala implementation of Networking and Cryptography (NaCl) library
• TweetNaCl + wrappers & bindings
  • TweetNaCl — a crypto library in 100 tweets (Daniel J. Bernstein, Bernard van Gastel, Wesley Janssen, Tanja Lange, Peter Schwabe, Sjaak Smetsers)
  • Erlang: TweetNaCl-amtal — Erlang bindings for TweetNaCl
  • Erlang: TweetNaCl-ulfl — Erlang NIF interface to TweetNaCl
  • Erlang: NaCerl — Erlang bindings for TweetNaCl
  • Go: tweetnacl-go — a wrapper around TweetNaCl
  • Javascript: crypto — abstraction layer for TweetNaCl
  • Jim TCL: jim-nacl — NaCl extension for Jim TCL (using TweetNaCl)
  • Objective-C: tweetnacl-objc — Objective-C bindings to the TweetNaCl crypto library
  • Lua: luatweetnacl — Lua wrapper arount the Tweet NaCl cryptographic library
    • lit-tweetnacl — luatweetnacl repackaged as a lit library
  • OCaml: ocaml-tweetnacl — TweetNaCl for OCaml
  • Perl6: perl6-tweetnacl
  • Python: Python-TweetNaCl — a wrapper around the C implementation of TweetNaCl
  • Python: python-tweetnacl — Python bindings to the "TweetNaCl" cryptography library
  • Q/KDB: qsalt — NaCl bindings for Q/KDB
  • Ruby: tweetnacl-ruby — TweetNaCl Ruby C-extension
  • Rust: rust-tweetnacl — Rust wrapper for TweetNaCl crypto library
  • Rust: knuckle — Rust bindings to TweetNaCl
  • Rust: libredsalt — Simple Rust bindings to the tweetnacl library
  • Swift: tweetnacl-swiftwrap — from Bitmark Inc.
  • TCL: nacl-tcl — tcl package for Networking and Cryptography library (pronounced "salt")
• TweetNaCl ports etc.
  • Ada: SPARKNaCl — SPARK 2014 re-implementation of TweetNaCl
  • Android: tweetnacl-android — TweetNaCl port to Android
  • C: tweetnacl-usable — TweetNaCl + randombytes()
  • C: tweetnacl-rongarret — a fork of TweetNaCl with several modifications
  • C#: tweetnacl-cs — A 100% native C# implementation of TweetNaCl for .NET
  • Common Lisp: naclcl — A direct translation of TweetNaCl into Common Lisp
  • CouchDB: couchnacl — Use TweetNaCl.js from inside CouchDB
  • D: tweetnacl.d — D port of tweetnacl
  • D: tweednacl — Pronounced as TweedSalt. A crypto library for D based on NaCl
  • Dart: tweetnacl-dart — Port of TweetNaCl cryptographic library to Dart
  • Dart: PineNaCl — a Dart implementation of TweetNaCl
  • Go: go-tweetnacl — A Go port of the TweetNacl library
  • Java: tweetnacl-java — rewrite tweetnacl.c in pure Java
  • Java: tweetnacl-java — A Java port of TweetNaCl from the original C
  • Java: salt-aa — A Java API to TweetNaCl implementations
  • JavaScript: TweetNaCl.js — Port of TweetNaCl / NaCl to JavaScript for modern browsers and Node.js
    • sodium-browserify-tweetnacl — wraps javascript port of tweetnacl with the api of chloride
    • purescript-crypt-nacl — TweetNaCl wrapper for Purescript
    • panda-confidential — Simple, extensible interface for the tweetnacl-js cryptography library
  • JavaScript: tweetnacl-nodewrap — Port of TweetNaCl / NaCl to javascript Node.js
  • Kotlin: tweetnacl-k — kotlin implementation of tweetnacl
  • Python: pure_pynacl — A pure python implementation of TweetNaCl
  • Q/KDB: qsalt — NaCl bindings for Q/KDB
  • Rust: sodalite — tweetnacl in rust
  • Rust: rust-tweetnacl — Port of TweetNaCl crypto library to pure-Rust
  • Rust: microsalt — High Level Pure Rust Crypto library for your trusty rusty programs
  • TypeScript: tweetnacl-ts — Port of TweetNaCl cryptographic library to TypeScript (and ES6)
• μNaCl — The Networking and Cryptography library for microcontrollers (Core team: Michael Hutter and Peter Schwabe)
  • ecdh-curve25519-mobile — X25519 for Android (AVRNaCl Java JNI wrapper)
• libsodium + wrappers & bindings
  • libsodium — a portable, cross-compilable, installable, packageable fork of NaCl (Frank Denis)
  • Ada: libsodium-ada
  • Ada: sodiumada
  • C#: NitraLibSodium
  • C++: sodiumpp
  • C++: sodium-wrapper
  • Clojure: caesium
  • Clojure: naclj
  • Common LISP: cl-sodium
  • Common LISP: foreign-sodium
  • Crystal: cox
  • Crystal: sodium.cr
  • Cuis: Cuis-Smalltalk-Crypto-NaCl
  • D: shaker
  • D: sodium
  • D: chloride
  • Delphi/FreePascal: libsodium-delphi
  • Dylan: sodium-dylan
  • Elixir: Savory
  • Elixir: libsalty
  • Erlang and Elixir: erlang-libsodium
  • Erlang: Erlang-NaCl
  • Erlang: Salt
  • Erlang: enacl
  • Flutter: flutter_sodium
  • Fortran: Fortium
  • Go: GoSodium
  • Go: libsodium-go
  • Go: sodium
  • Hack: Nuxed Crypto
  • Haskell: Saltine
  • Haskell: lithium
  • HaXe: haxe_libsodium
  • Idris: sodium-idris
  • Java: kalium
  • Java: jsodium
  • Java: libsodium-jna
  • Java JNI: libsodium-jni
  • Java JNI: libstodium
  • Java JNI: sodium-jni
  • Java JNI: libsodium-jni
  • JavaScript: sodium-plus
  • JavaScript: js-nacl
  • JavaScript: sodium-native
  • JavaScript: dholecrypto-js
  • Julia: Sodium.jl
  • Kotlin: kotlin-multiplatform-crypto
  • Lua: jprjr-luasodium
  • Lua: luasodium
  • Mruby: mruby-libsodium
  • Nativescript: nativescript-libsodium
  • Nim: nim-libsodium
  • NodeJS: node-sodium
  • NodeJS: Natrium
  • Objective-C: SodiumObjc
  • Objective-C: NAChloride
  • OCaml: ocaml-sodium
  • Perl: Crypt-Sodium
  • Perl: crypt-nacl-sodium
  • Pharo/Squeak: Crypto-Nacl
  • PHP: libsodium-php
  • PHP: php-sodium
  • PHP: php
  • PHP: halite
  • PHP polyfill: sodium_compat
  • Pony: pony-sodium
  • Python: PyNaCl
  • Python: libnacl
  • Python: pysodium
  • Python: libnacl
  • Python: csodium
  • Python: libsodium-python-examples
  • R: sodium
  • Racket: part of CRESTaceans
  • Realbasic and Xojo: RB-libsodium
  • Ruby: RbNaCl
  • Ruby: ffi-libsodium
  • Ruby: sodium
  • Ruby: jodid
  • Ruby: RbNaCl::Libsodium
  • Rust: Sodium Oxide
    • ecdh_wrapper — rust ecdh wrapper for sodiumoxide's X25519
  • Rust: libsodium-ffi
  • Rust: rust_sodium
    • libsodium-neon — Node.js bindings to rust_sodium
  • Swift: swift-sodium
  • Swift: NaOH
  • UWP: libsodium-uwp
  • V: libsodium
• libsodium.js — The sodium crypto library compiled to pure JavaScript using Emscripten
  • natrium-browser — libsodium.js wrapped with natrium api
  • haxe_libsodium — haxe bindings for libsodium.js
  • sodium-browserify — A polyfil between the apis of node-sodium and libsodium-wrappers
• Robosodium — Quick scripted compilation of Libsodium for Android

lib25519

lib25519 "is a microlibrary for the X25519 encryption system and the Ed25519 signature system" that can be used directly in C or called by libraries in other languages using FFI. See the website for more information.

• C/ASM: lib25519 (many authors; lib25519 maintained by Daniel J. Bernstein)
• Python: python-lib25519

LibHydrogen

The Hydrogen library is designed for constrained environments like embedded devices, IoT (Internet of Things), and tiny computers.

• libhydrogen — a small, easy-to-use, hard-to-misuse cryptographic library for constrained environments
• C#: Hydrogen-CSharp
• Carp: hydrogen
• Go: libhydrogen-go
• Java: hydride-java
• MRuby: mruby-libhydrogen
• Node.js: node-libhydrogen-binding
• PHP: Phydro
• Python: pyhy
• Rust: rust-libhydrogen
• Rust: rust-libhydrogen-sys

Crypto Libraries

• Curve25519 standalone (native implementations)
  • ASM: DJB's implementation (Dan Bernstein)
  • ASM: Sandy2x (Tung Chou)
  • ASM: curve25519-asm (Pieter Hintjens)
  • ASM: curve25519-atmega (Michael Düll, Björn Haase, Gesine Hinterwälder, Michael Hutter, Christof Paar, Ana Helena Sánchez, and Peter Schwabe)
  • ASM: curve25519-msp430 (Gesine Hinterwälder)
  • ASM: curve25519-cortexm0 (Björn Haase and Ana Helena Sánchez)
  • ASM (ARMv7): X25519-Cortex-M4 (Emil Lenngren)
  • C: curve25519-donna (Adam Langley)
  • C: curve25519-donna-floodyberry (Andrew Moon)
  • C: curve25519-mehdi (Mehdi Sotoodeh)
  • C: curve25519-meh (Marek Koza)
  • C (ATXMEGA): CurveX (Alexandru Mereacre)
  • C++ curve25519-uwp (Jeff R)
  • C#: curve25519 (Hans Wolff)
  • C#: curve25519-pcl (Jeff R)
  • C#: curve25519-dotnet (signal-csharp)
  • C#: X25519-CSharp (Hirbod Behnam)
  • C#: ECDH-Curve25519 (frankigamez)
  • Cell Broadband Engine: celldh (Peter Schwabe, Neil Costigan)
  • Dart: curve25519 (terrier989)
  • Dart: curve25519 (Tougee)
  • Elixir: curve25519_ex (Matt Miller)
  • Go: curve25519 (golang.org/x/crypto/curve25519)
  • Go: go-x25519 (Rio)
  • Haxe: hx25519 (Anton Nesterov)
  • Java: curve25519-java (Dmitry Skiba)
  • Java: curve25519-java (Trevor Bernard)
  • Java: actor-curve25519 (Actor Messaging)
  • Java: ecdh-curve25519-java (G. B. Versiani)
  • Javacard: jc_curve25519 (David Oswald)
  • JavaScript: ed2curve-js (Dmitry Chestnykh)
  • JavaScript: curve255js (Michele Bini)
  • JavaScript: js-x25519 (Mykola Bubelich)
  • JavaScript: noble-ed25519 (Paul Miller)
  • OCaml: Callipyge (OKLM WSH)
  • Perl: crypt-curve25519 (Alex J. G. Burzynski)
  • PHP: PHP-Curve25519 (Leigh)
  • Python: python-pure25519 (Brian Warner)
  • Ruby: rb-pure25519 (Daniel Pruessner)
  • Rust: x25519-dalek (Isis Agora Lovecruft)
  • Verilog: curve25519-verilog (Andres Erbsen)
  • VHDL: naclhw (Michael Hutter, Jürgen Schilling, Peter Schwabe, Wolfgang Wieser) — NaCl's crypto_box
• Curve25519 standalone (wrappers & bindings)
  • Erlang: curve25519 (Lemoi)
  • Haskell: hs-curve25519 (Austin Seipp)
  • Haskell: curve25519 (Adam Wick)
  • JavaScript: curve25519.js (Robert Picard)
  • Node.js: node-curve25519 (Jann Horn)
  • Node.js: node-curve25519 (Vito Sartori)
  • Objective-C: 25519 (Frederic Jacobs)
  • PHP: php-curve25519-ext (Leigh)
  • PHP: curve25519-php (mgp25)
  • Python: pycurve25519 (Thomas)
  • Python: donna25519 (Muterra, Inc)
  • Python: donna25519 (Nick Badger, Brian Warner)
  • Ruby: x25519 (Crypto.rb)
• Noise Protocol Libraries
  • noise — Go implementation of the Noise Protocol Framework
  • snow — Rust implementation of Noise
  • noise-rust — Rust implementation of Noise
  • noise-java — Plain Java implementation of the Noise protocol
  • cacophony — A Haskell library implementing the Noise protocol
  • dissononce — A python implementation for Noise Protocol Framework
  • noiseprotocol — Noise Protocol Framework - Python 3 implementation
  • dissononce — A python implementation for Noise Protocol Framework
  • consonance — WhatsApp's handshake implementation using Noise Protocol
  • noise-protocol — Javascript implementation of the Noise Protocol Framework based on libsodium
  • The-Noise-Protocol — The Noise Protocol in python
  • noise-peer — Simple end-to-end encrypted, secure channels using Noise Protocol Framework and libsodium secretstream
  • Noise-C — a plain C implementation of the Noise Protocol
    • noise-c.wasm — rweather/noise-c compiled to WebAssembly using Emscripten and optimized for small size
  • noise — Python implementation of Noise protocol framework
• CurveCP
  • libcurvecpr — a low-level, networking-independent implementation of Daniel J. Bernstein's CurveCP
  • libcurvecpr-glib — GLib bindings for libcurvecpr
  • libchloride — the networking layer for libsodium, based on CurveCP
  • curvecp — CurveCP protocol implementation in pure Javascript
  • curvecp_handshake.rb — CurveCP handshake protocol in Ruby
  • libcurvecpr-asio — Boost.ASIO bindings for libcurvecpr (implementation of CurveCP)
  • curved_gear — Rust implementation of CurveCP
• CurveZMQ
  • CurveZMQ — Security for ZeroMQ
  • azmq — An asyncio-native implementation of ZMTP (has CURVE support)
  • ParaZMQ — a pure-Go implementation of ZeroMQ 4.0's ZMTP/3.0
  • libbitcoin-server — Bitcoin Full Node and Query Server
  • zmq-rs — Another ZeroMQ binding for Rust
• Elligator
  • elligator.py — Python reference implementation, see related post
  • Elligator-2 — C and Javascript implementations of the Elligator 2 algorithm for Curve25519
  • helligator — haskell implementation of elligator
  • libelligator — A C++ Elligator2 implementation
  • pyelligator — Python binding for libelligator

Other Libraries

• Go Crypto Library — from the Go programming language
• PHP 7.2.0+ — a popular general-purpose scripting language that is especially suited to web development
• Java 11+ — includes x25519 support
• Zig supports x25519 in the standard library
• ring — Safe, fast, small crypto using Rust & BoringSSL's cryptography primitives
• HACL* — a formally verified cryptographic library written in F*
• titun-hacl — Rust bindings for hacl* ChaCha20Poly1305 and Curve25519
• Orion — a cryptography library written in pure Rust
• Nettle — a low-level cryptographic library
  • Bindings available in Haskell, Perl, Pike, PostgreSQL, R6RS Scheme, and TCL
• libzmq — ZeroMQ core engine in C++, implements ZMTP/3.0
• Rust-Crypto — A (mostly) pure-Rust implementation of various common cryptographic algorithms
• ninn — An experimental implementation of nQUIC in Rust
• LiteSpeed QUIC (LSQUIC) — implementation of QUIC and HTTP/3 functionality for servers and clients
• Libgcrypt — a general purpose cryptographic library originally based on code from GnuPG
• Monocypher — a small, secure, auditable, easy to use crypto library
  • LuaNacha — Lua wrapper for Monocypher
  • monocypher.cr — Crystal bindings for Monocypher
  • monocypher-go — Go language bindings for Monocypher
• phpseclib — PHP Secure Communications Library
• o3 — Open-source implementation of the Threema protocol in Go
• libsuola — An ENGINE gluing together OpenSSL and NaCl-derived crypto
• tink — a small crypto library that provides a safe, simple, agile and fast way to accomplish some common crypto tasks
• CIRCL — Cloudflare Interoperable Reusable Cryptographic Library
• keybase-client — Keybase Go Library, Client, Service, OS X, iOS, Android, Electron
• NewHope_X25519_XSalsa20_Poly1305 — Post Quantum Cryptography with NewHope and NaCl
• libgodium — Pure Go implementation of cryptographic APIs found in libsodium
• libaxolotl-crypto-node — Node.js implementation of cryptography interface for libaxolotl-javascript
• libaxolotl-uwp — An independent implementation of the axolotl protocol, loosely based on libaxolotl-java
• rust-ed25519-compact — Small, wasm-friendly, zero-dependencies Ed25519 and X25519 implementation for Rust
• libaxolotl-crypto-web — WebCrypto implementation of cryptography interface for libaxolotl-javascript
• ratchet.lisp — A Common Lisp implementation of the Signal double-ratchet using TweetNaCl as the crypto primitives
• hc — HomeControl is an implementation of the HomeKit Accessory Protocol (HAP) in Go
• Olm — Implementation of the olm and megolm cryptographic ratchets
• dnscrypt — A very simple DNSCrypt client library written in Go
• libssh — multiplatform SSH library in C
• tweetnacl-sealed-box — libsodium's sealed box implementation for TweetNaCl
• hs-nacl — Modern Haskell Cryptography
• luazen — a small library with various compression, encoding and cryptographic functions for Lua
• OpenPGP.js — an Open Source OpenPGP library in JavaScript
• kcl — NaCl substitute of sorts in Elixir
• librnp — C library approach to OpenPGP
  • ruby-rnp — Bindings for RNP in Ruby
• Salt — NaCl cryptography library for PHP (not by the NaCl authors)
• Sapient — Secure API toolkit
• rust-crypto-decoupled — Experiment on dividing rust-crypto into several small crates
• chloride — a Cryptography Library (Cl) for javascript enviroments
• OpenBazaar-libsignal — Custom implementation of the signal messaging protocol in Go
• Neuro:pil — a small messaging library which by default adds two layers of encryption
• GopenPGP — A high-level OpenPGP library
• libsaxolotl — axolotl based on libsodium
• salt-channel-c — C implementation of Salt Channel
• asn — asn implements the Apptimist Social Network Protocol
• eddy — a steady little Ed25519 library for Elixir
• easy-ecc — A usability wrapper for PHP ECC
• bc-java — Bouncy Castle Java Distribution
• x3dh — an implementation of the x3dh key agreement protocol
• go-sphinxmixcrypto — golang sphinx mix net cryptography
• sphinxmixcrypto — python sphinx mix net cryptography
• aiootp — Asynchronous pseudo-one-time-pad based crypto and anonymity library
• mipher — Mobile Cipher library written in clean TypeScript
• amber — Cryptography library. X25519, Ed25519, ChaCha20, Blake2, Poly1305, Scrypt
• mbedcrypto — a portable, small, easy to use and fast c++14 library for cryptography
• nitro-python — Python bindings for nitro
• cryptopeer-crypto — Crypto module for CryptoPeer
• mruby-httpsclient — An http(s) web client using mruby and LibreSSL's libtls
• dnscrypt — Very basic DNSCrypt library for Go
• arduinolibs-Crypto — Arduino libraries and examples
• ed25519-to-x25519.wasm — Library for Ed25519 signing key pair into X25519/Curve25519 key pair suitable for Diffie-Hellman key exchange
• nsec — A modern and easy-to-use crypto library for .NET Core based on libsodium
• Sequoia-PGP — a modern modular OpenPGP implementation in Rust
• ezcrypt — Ezcrypt is intended to make it easy to work with nacl/box in a safe and secure way
• TweetPepper — Formats, PKI using TweetNaCl as the Crypto
• boxconn — adds encryption and authentication to a network connection
• yowsup — The python WhatsApp library
• Lazysodium — a complete Android implementation of the Libsodium library
• cryptostack — cryptographic library based on Curve25519, Ed25519, blake2b, Poly1305, XSalsa20 primitives
• eccsnacks — a simple reference implementation of Curve25519 and Curve448
• CrunchyCrypt — Safe and Simple Cryptography
• Glow — a reference client library for interacting with Zax
• curve25519-go — Curve25519 signatures (and also key agreement) like in the early Axolotl, ported to Go
• curve25519-kotlin — Curve25519 signatures (and also key agreement) like in the early Axolotl, ported to Kotlin
• curve25519-swift — Curve25519 signatures (and also key agreement) like in the early Axolotl, ported to swift
• nnshake — Simple ECDH handshake protocol in Rust, based on X25519 and ChaCha20-Poly1305
• nuntius — iOS Framework for end-to-end encrypted messages
• salt-channel — A Java implementation of Salt Channel - a simple, light-weight secure channel protocol
• proto-quic — intended as a standalone library for QUIC
• Neqo — an Implementation of QUIC written in Rust
• goquic — QUIC support for Go
• bencrypt — Encryption Abstraction Layer and Utilities for ratnet
• asymmetric-crypto — Encryption and signing using public-key cryptography (via TweetNaCl)
• mino — Experimental password manager core
• cryptonite — a haskell repository of cryptographic primitives
• NaclTest — curve25519 encryption using libsodium.js (in the browser) and decryption using kalium (java, server side)
• cryptofamily — a heap of primitives, algorithms, etc.
• secure_serialisation — To be used only with transient nacl key pairs Public Key authenticated encryption (box)
• rawr-x3dh — TypeScript implementation of X3DH
• Virgil Crypto Library — modern cryptography libraries (ECIES and RSA with Cryptographic Agility) and all the necessary infrastructure
• ecc25519 — combine golang ed25519 and curve25519 libray in one
• ecc-playground — Playground project for ECC with Curve25519 and AES-GCM on the JVM
• libsignal_protocol_dart — a pure Dart/Flutter implementation of the Signal Protocol
• saxolotl — salty axolotl ratchet
• curve25519-js — Curve25519 Javascript Implementation
• krb5-spake25519 — Sandbox for Curve25519 SPAKE testing for krb5
• crypto — some additional cryptographic packages for Go
• ara-crypto — Cryptographic functions used in various Ara modules
• yii2-api — A Yii2 API Skeleton Framework
• go-ecdh — Golang implementation of the elliptical curve diffie-hellman
• rfc7748_precomputed — optimized implementations of X25519 and X448 (RFC-7748) for 64-bit architectures
• opt-cryptobox — Optimized cryptobox self-contained library
• raaz — Cryptographic network library for Haskell
• curvetls — A robust framing and encryption layer for your Go network programs, based on CurveZMQ
• prototok — RbNaCl + json/msgpack/protobuf key generation/parsing gem
• cryptoengine — This Golang package simplifies even further the usage of NaCl crypto primitives
• libsodium-laravel — Laravel integration for libsodium
• shick_crypto — Crypto library showing how to use NaCl and libsodium to encrypt and decrypt message securely
• cifra — A collection of cryptographic primitives targeted at embedded use
• lockbox — File encryption for Ruby and Rails
• SodiumBox — LibSodium crypto_box_seal in Go
• sshlib — ConnectBot's SSH library
• dat-wot — [WIP] A decentralized public key network with encryption utilities for data collaboration
• boxtransport — encrypted communication over TCP using NaCl boxes
• Personal-HomeKit-HAP — build HomeKit support accessories
• fld-ecc-vec — an optimized library for computing EdDSA and the Diffie-Hellman functions X25519 and X448
• sshj — ssh, scp and sftp for java
• forward-secrecy — Javascript implementation of the Axolotl key-ratcheting protocol using the NaCl crypto library
• haskell-crypto-box — An interface for authenticated public-key encryption a la NaCl
• AeroGear — Libraries to simplify and unify mobile development across different platforms
• threema-msgapi-sdk-php — Gateway MsgApi SDK - PHP
• ecurvecp — based on CurveCP but has more in common with CurveZMQ
• private-box — private message between two parties (with no `to` field)
• plc — Pure Lua Crypto
• ruby-jose — JSON Object Signing and Encryption (JOSE) for Ruby
• erlang-jose — JSON Object Signing and Encryption (JOSE) for Erlang and Elixir
• HeavyThing — x86_64 assembler library
• ECC-25519 — using ECC with Curve25519; combines multiple libraries
• ESP8266-Arduino-cryptolibs — Collection of strong crypto libs that can be included in Arduino-core for ESP8266
• curve25519-java — Pure Java and JNI backed Curve25519 implementation
  • scrypto — Cryptographic primitives for Scala (includes Curve25519-Java wrapper)
• dnscrypt-python — DNSCrypt Python Library
• c25519 — Curve25519 and Ed25519 for low-memory systems
• python-axolotl-curve25519 — curve25519 with ed25519 signatures, used by libaxolotl
• proteus — Axolotl Protocol Implementation
• python-axolotl — Python port of libaxolotl
• python-axolotl-curve25519 — python wrapper for curve25519 library with ed25519 signatures
• libaxolotl-php — Axolotl Library For PHP
• libaxolotl-javascript — A JavaScript implementation of axolotl
• libaxolotl-crypto-curve25519 — emscripten compiled version of curve25519 and ed25519
• python-omemo — Python OMEMO Library
• libsqrl — a library implementing the SQRL Specification
• ecdh — A generic ECDH implementation
• molch — An implementation of the axolotl ratchet based on libsodium
• erlang-libdecaf — ed448goldilocks (libdecaf) NIF with timeslice reductions for Erlang and Elixir (also supports X25519)
• SharpTox — Wrapper library for Tox core, av and dns functions
• minicrypt — Library of crypto primitives for embedded systems
• jnacl — Pure Java implementation of curve25519xsalsa20poly1305
• asio_sodium_socket — Custom transport encryption using libsodium and Asio
• libeddsa — cryptographic library for ed25519 and curve25519
• tox4j — New and improved java wrapper for Tox
• curve-protocol — Javascript implementation of the CurveCP protocol inspired by the ZeroMQ implementation
• microstar-crypto — JavaScript cryptography library for Microstar, wrapping TweetNaCl
• SharedEcc25519 — ANSI-C based cross-platform elliptic curve cryptography provider with objc api
• secret-handshake — Javascript-based authentication
• libquic — QUIC, a multiplexed stream transport over UDP
• SQRL-Protocol — A helper library to handle SQRL requests and responses
• gocusp — Go bindings (using SWIG) for the Channel-based Unidirectional Stream Protocol
• hs-curve25519-arithmetic — Arithmetic on Curve25519 in Haskell
• nacl.js — JavaScript implementation of curve25519xsalsa20poly1305
• potassium — Randomized forward-secure Curve25519-AES256-CTR-HMAC-SHA512 for Pythonista
• Ordo — Symmetric Cryptography Library, which also includes Curve25519 support
• seconn — A simple secure socket library for Go
• elliptic — Fast elliptic-curve cryptography in plain javascript
• librdns — Asynchronous DNS resolver with DNSCurve support

Miscellaneous

• Dan Bernstein: "An attacker who spends a billion dollars on special-purpose chips to attack Curve25519, using the best attacks available today, has about 1 chance in 1000000000000000000000000000 of breaking Curve25519 after a year of computation."
• Dmitry Chestnykh: "You can write a program to generate Curve25519 private key faster than PGP generates its private key."
• Adam Langley: "Of the concrete implementations of Diffie-Hellman, curve25519 is the fastest, common one. There are some faster primitives in eBACS, but the ones that are significantly faster are also significantly weaker."
• Matthew Green: "Any potential 'up my sleeve' number should be looked at with derision and thoroughly examined (Schneier thinks that the suggested NIST ECC curves are probably compromised by NSA using 'up my sleeve' constants). This is why I think we all should embrace DJB's curve25519."
• Frederic Jacobs: "It's incredible to realize that the TextSecure protocol enabled the largest end-to-end encrypted messaging deployement in history."
• GnuPG: "For many people the NIST and also the Brainpool curves have an doubtful origin and thus the plan for GnuPG is to use Bernstein's Curve 25519 as default. GnuPG 2.1.0 already comes with support for signing keys using the Ed25519 variant of this curve. This has not yet been standardized by the IETF (i.e. there is no RFC) but we won't wait any longer and go ahead using the proposed format for this signing algorithm."
• Ian Grigg: "In the past, things like TLS, PGP, IPSec and others encouraged you to slice and dice the various algorithms as a sort of alphabet soup mix. Disaster. What we got for that favour was code bloat, insecurity at the edges, continual arguments as to what is good & bad, focus on numbers & acronyms, distraction from user security, entire projects that rate your skills in cryptoscrabble, committeeitus, upgrade nightmares, pontification ... Cryptoplumbing shouldn't be like eating spagetti soup with a toothpick. There should be One Cipher Suite and that should do for everyone, everytime. There should be no way for users to stuff things up by tweaking a dial they read about in some slashdot tweakabit article while on the train to work... Picking curve25519xsalsa20poly1305 is good enough for that One True CipherSuite motive alone... It's an innovation! Adopt it."
• wolfSSL: "Curve25519 so far is destroying the key agreement and generation benchmarks of previous curves, putting up numbers for both key agreement and generation that are on average 86 percent faster than those of NIST curves."
• Adam Langley: "Current ECDSA deployments involve an ECDSA key in an X.509 certificate and ephemeral, ECDHE keys being generated by the server as needed. These ephemeral keys are signed by the ECDSA key. A similar design would have an Ed25519 key in the X.509 certificate and curve25519 used for ECDHE. I don't believe there's anything needed to get that working save for switching out the algorithms."

Timeline notes

• 2005-05-19: Seminar: "High-speed elliptic-curve cryptography"
• 2005-09-15: Curve25519 software is online.
• 2005-09-20: Invited talk at ECC 2005.
• 2005-11-15: Paper (first published): Curve25519: new Diffie-Hellman speed records
• 2008-08-22: DNSCurve is announced by Dan Bernstein.
• 2009-06-02: Matthew Dempsky's DNSCurve patch for dnscache is released.
• 2010-02-23: OpenDNS adopts DNSCurve.
• 2010-02-26: DNSCurve RFC draft-dempsky-dnscurve-01 is published.
• 2010-12-28: CurveDNS 0.87 is released.
• 2010-12-28: CurveCP is announced at 27C3.
• 2011-02-21: The most recent NaCl is released.
• 2011-02-21: Prototype CurveCP tools are included in NaCl.
• 2011-12-06: DNSCrypt is announced by OpenDNS.
• 2011-12-06: DNSCrypt for OSX initial public release.
• 2012-05-08: DNSCrypt for Windows is available.
• 2012-11-24: First release of dnscrypt-wrapper, by Yecheng Fu.
• 2013-03-06: The Sodium crypto library is announced.
• 2013-03-09: Chromium enables Curve25519 key exchange code for QUIC.
• 2013-05-22: MinimaLT is introduced.
• 2013-06-05: Edward Snowden / NSA disclosures begin.
• 2013-07-19: First release of TweetNaCl.
• 2013-09-15: Bruce Schneier recommends avoiding NSA/NIST curves. Curve25519 is safe.
• 2013-09-25: curve25519-sha256@libssh.org is proposed.
• 2013-10-13: TextSecure migrates to Curve25519.
• 2013-12-12: Tor adds Curve25519 support in version 0.2.4.19.
• 2013-12-31: PolarSSL, now known as mbed TLS, adds Curve25519 support in version 1.3.3.
• 2014-01-08: libssh adds curve25519-sha256@libssh.org in version 0.6.0.
• 2014-01-29: OpenSSH makes Curve25519 the default key exchange in version 6.5.
• 2014-02-16: First (experimental) release of TinySSH.
• 2014-02-17: Cloudflare announces plans to deploy QUIC.
• 2014-08-25: DJB recommends referring to Curve25519 Montgomery-X-coordinate Diffie-Hellman as X25519.
• 2014-09-30: wolfSSL seeks Curve25519 beta testers.
• 2014-10-26: dqcache is introduced by Jan Mojžíš.
• 2014-11-18: WhatsApp gains support for the TextSecure protocol.
• 2015-01-24: IETF CFRG adopts draft-agl-cfrgcurve-00, specifying Curve25519.
• 2015-03-04: "Curve25519 now supported at the wolfCrypt level, wolfSSL layer coming soon."
• 2015-04-07: Nettle 3.1 adds support for Curve25519.
• 2015-06-12: Curve25519 is now an IETF/TLS working group item.
• 2015-11-17: BoringSSL (from Google) adds X25519 support.
• 2016-01-20: BoringSSL: "Enable X25519 by default in TLS."
• 2016-01-24: RFC 7748 is published.
• 2016-03-30: The Axolotl Protocol is renamed Signal Protocol.
• 2016-04-05: WhatsApp completes Signal Protocol integration.
• 2016-04-15: Libgcrypt 1.7.0 supports Curve25519.
• 2016-04-21: dnsdist 1.0.0 supports DNSCrypt.
• 2016-04-23: X25519 is enabled in Chrome.
• 2016-05-09: GnuTLS 3.5.0 gets X25519 support (disabled by default, waiting on IETF).
• 2016-05-18: BoringSSL gets concatenated X25519 + NEWHOPE (post-quantum) key agreement.
• 2016-06-16: SSL Labs announces support for X25519.
• 2016-07-08: Open Whisper Systems announces Signal Protocol in Facebook Messenger (disabled by default).
• 2016-07-18: Caddy 0.9 (announcement links, plural, removed) adds experimental QUIC support.
• 2016-08-25: OpenSSL 1.1.0 supports X25519.
• 2016-10-26: Botan 1.11.33 adds X25519 support for TLS.
• 2017-01-13: SSL Labs adds x25519 detection support.
• 2017-01-24: Firefox 51 gets X25519 support.
• 2017-01-29: BearSSL 0.3 gets X25519 support.
• 2017-02-01: LibreSSL 2.5.1 gets X25519 support.
• 2017-02-16: Go 1.8 adds X25519 support to crypto/tls.
• 2017-02-21: PuTTY 0.68 gets X25519 support.
• 2017-04-24: Unbound 1.6.2 gets DNSCrypt support.
• 2017-05-22: Cloudflare announces X25519 key exchange support.
• 2017-08-16: Audit of libsodium finds it "is indeed a secure, high-quality library that meets its stated usability and efficiency goals."
• 2017-09-13: Mozilla announces formally verified Curve25519 for Firefox 57.
• 2017-09-18: Tor 0.3.2.1-alpha debuts next-generation onion services with SHA3/ed25519/curve25519.
• 2017-10-31: NIST to include Curve25519 in their approved curves.
• 2017-11-30: PHP 7.2.0 adds libsodium.
• 2018-01-09: Tor 0.3.2.9 upgrades to SHA3/ed25519/curve25519 for production.
• 2018-07-26: Cloudflare reaffirms its intention to deploy QUIC for its customers.
• 2018-08-02: Linux will merge WireGuard into the kernel!
• 2018-08-11: RFC 8446, TLS 1.3, is published.
• 2018-09-25: Java 11 adds support for X25519.
• 2018-12-20: WireGuard for iOS - now in the App Store.
• 2019-01-12: nQUIC is introduced.
• 2019-02-16: WireGuard for macOS is announced.
• 2019-03-27: Cloudflare announces BoringTun.
• 2019-06-20: Cloudflare introduces CIRCL.
• 2019-07-17: OPNsense 19.7 includes WireGuard support.
• 2019-12-08: WireGuard merged into net-next.
• 2020-03-29: Linux kernel 5.6 is released, including WireGuard.
• 2020-06-21: WireGuard Merged Into OpenBSD.
• 2020-07-08: Cure53 audit of Monocypher finds no serious issues.
• 2020-10-18: OpenBSD 6.8 includes WireGuard support.
• 2021-10-20: Native DNSCurve support in tinydns, in djbdnscurve6.
• 2021-11-03: Orion 0.16.1 adds formally verified X25519.
• 2022-02-23: OpenSSH 8.9 is released, including sntrup761x25519-sha512@openssh.com enabled by default.
• 2022-04-08: OpenSSH 9.0 is released, elevating sntrup761x25519-sha512@openssh.com to the default key exchange.
• 2022-04-26: First apparent release of lib25519.
• 2023-04-11: FreeBSD 13.2 adds WireGuard support.
• 2023-09-19: Signal announces PQXDH, combining x25519 and CRYSTALS-Kyber
• DNSCurve and CurveCP have always supported it.
• NaCl and libsodium have always supported it.

X25519 support coming soon!

• shibari intends to support DNSCurve
• kage — WIP Kotlin implementation of the age file encryption format
• identity encryption in 3GPP 5G — for protection against IMSI catchers
• Skype is beta testing a "Private Conversations" feature, powered by Signal Protocol
• Mastodon — "Add end-to-end encryption API"
• WireGuard in kernel for NetBSD
• MinimaLT — A super fast, super secure transport protocol
• Ethos — An operating system to make it far easier to write applications that withstand attack
• Microsoft TLS
• Zcash — a decentralized and open source cryptocurrency using groundbreaking cryptography (details)
• Monero — is moving to ZMTP for p2p transport, enforcing CurveZMQ only between peers
• Upspin — "TODO(ehg) add "25519": x/crypto/curve25519, github.com/agl/ed25519"
• dotp-crypt — dOTP library
• Tendermint — Simple, Secure, Scalable Blockchain Platform
• antinet-before-yedino — safe decentralized network for data and contracts
• nnathan-noiseprotocol — Noise Protocol in Python
• messagesodium — Patches ActiveSupport's MessageEncryptor to use libsodium
• x25519-workshop — Pure JS ES2015 Implementaion of the Curve25519 Diffie-Hellman function
• petmail — secure messaging, file-transfer, and directory synchronization
• End-To-End — a Chrome extension that helps you encrypt, decrypt, digital sign, and verify signed messages within the browser using OpenPGP
• curve_tun — TCP tunnels secured by Curve25519
• pouch-box — Asymmetric encrypted PouchDB, powered by NaCl's curve25519-xsalsa20-poly1305
• Blight — a Tox client written in Racket that utilizes libtoxcore-racket
• GnuPG — end-to-end encrypted email. Note: Alternatives like age support Curve25519 now!

"Powered by Curve25519"