curve25519-dalek

curve25519-dalek is a pure-Rust implementation of group operations on the Curve25519 elliptic curve and its Ristretto255 prime-order group construction, providing constant-time scalar and point arithmetic as the low-level foundation other cryptographic protocols are built on. It’s the anchor crate of the dalek-cryptography monorepo, which also houses ed25519-dalek (EdDSA digital signatures) and x25519-dalek (Diffie-Hellman key exchange) as separate crates that depend on it, plus curve25519-dalek-derive, a small proc-macro helper crate used internally.

The library emphasizes side-channel resistance (constant-time operations to avoid timing attacks) and supports no_std environments, making it suitable for embedded and constrained targets in addition to standard server and client applications. With over 211 million cumulative downloads, it is one of the most widely depended-on cryptography primitives in the Rust ecosystem, underpinning higher-level protocols across TLS libraries, blockchain implementations, and messaging systems.

What You Get

• Constant-time (timing-attack-resistant) scalar and point arithmetic over Curve25519 and the Ristretto255 prime-order group
• Both Edwards-curve and Montgomery-curve point representations, covering the needs of EdDSA signatures and Diffie-Hellman key exchange respectively
• no_std support for embedded and constrained environments alongside standard use
• Multiple backend implementations (portable, SIMD-accelerated) selected via Cargo features for performance tuning per target
• The foundation crate that ed25519-dalek and x25519-dalek build their higher-level protocol implementations on top of, all versioned and released together from the same workspace

Common Use Cases

• Implementing custom cryptographic protocols (zero-knowledge proofs, ring signatures, threshold schemes) that need raw Ristretto255/Curve25519 group operations
• Serving as a dependency for higher-level crates like ed25519-dalek and x25519-dalek rather than being used directly by most application code
• Building blockchain or distributed-ledger primitives that use Ristretto255 for commitment schemes or aggregate signatures
• Embedded/IoT cryptography where a no_std, side-channel-resistant elliptic-curve implementation is required

Under The Hood

Architecture - The repository is a Cargo workspace with four member crates: curve25519-dalek (this package — the core field/scalar/point arithmetic), ed25519-dalek (EdDSA built on top of the Edwards point type), x25519-dalek (Diffie-Hellman built on top of the Montgomery point type), and curve25519-dalek-derive (proc-macros used internally to generate repetitive arithmetic code). All four crates share one CI pipeline and are versioned independently but released from the same monorepo — the standalone dalek-cryptography/ed25519-dalek repository is archived with a notice pointing here, confirming this is the canonical, actively maintained location. Tech Stack - Rust edition 2024, MSRV 1.85.0, with no_std support built in via Cargo feature flags and multiple selectable arithmetic backends (a portable, safe backend and SIMD-accelerated backends) so consumers can trade off compile complexity for performance. Dual-licensed BSD-3-Clause (curve25519-dalek and ed25519/x25519-dalek) with the derive crate additionally offering Apache-2.0/MIT. Code Quality - The core crate alone spans roughly 34,600 lines of Rust across src/; correctness for elliptic-curve arithmetic is safety-critical, so the project maintains dedicated per-crate CI workflows (visible in the README’s per-crate CI badges) and a CONTRIBUTING.md with process expectations for a cryptography library where subtle arithmetic bugs have security consequences. Constant-time discipline (avoiding secret-dependent branches or memory accesses) is a first-class design constraint reflected throughout the codebase, not an afterthought. API Design - As a primitive-arithmetic library rather than a protocol library, the API surface (scalar/point types with arithmetic trait implementations) is intentionally low-level and unopinionated; most developers are expected to consume it transitively through ed25519-dalek or x25519-dalek rather than calling curve25519-dalek APIs directly, which keeps its own surface small and focused at the cost of a steeper learning curve for anyone building directly against it.