Module crypto::x25519

X25519 Diffie-Hellman (RFC 7748).

Curve25519's Montgomery-ladder scalar multiplication on 32-byte little-endian u-coordinates, in constant time: a fixed 255-step ladder with branch-free conditional swaps, and field arithmetic (mod 2^255 - 19, sixteen 16-bit limbs) with no data-dependent branches or table lookups. The key exchange TLS 1.3's x25519 group uses (std/tls).

unsigned char priv[32], pub[32], shared[32];
rng.fill(&priv[0], 32UL);
std::x25519_public(pub[..], priv[..]);           // 32-byte slices
if (!std::x25519(shared[..], priv[..], peer_pub[..])) { /* low-order peer key */ }

Freestanding-safe.