On this page
X25519 is a key agreement function on the elliptic curve Curve25519 that lets two parties, each holding a private key and the other's public key, compute the same shared secret without ever sending that secret over the network.
How it works
X25519 is specified in RFC 7748, published in January 2016. In outline:
- Each party generates 32 random bytes as a private key.
- Each computes a 32-byte public key from it and publishes that.
- Each combines its own private key with the other's public key. Both arrive at the same 32-byte value.
An observer who sees both public keys cannot compute that value. The shared secret is not used as a key directly; it is fed into a key derivation function such as HKDF to produce the actual encryption key.
Why it is widely used
- Small keys. Private keys, public keys and shared secrets are all 32 bytes.
- Available in browsers. Recent versions of the major browsers expose it through WebCrypto, so web apps don't need to ship their own implementation.
Sealing a key to a recipient
A common use is sealing: encrypting a small payload so that only the holder of one private key can open it, without any prior conversation. The sender creates a fresh, one-time key pair, performs X25519 with the recipient's public key, derives a symmetric key, encrypts the payload and attaches the one-time public key. The recipient repeats the computation with their private key.
How Crunu uses it
Crunu uses X25519 to seal each environment key to each key holder: members, machines and service tokens that receive the key, plus the organization recovery key for shared environments. The key derived from the exchange encrypts the payload with AES-256-GCM. The browser does this through WebCrypto, which is why Crunu needs Chrome 113 or later, Safari 17 or later, or Firefox 129 or later. The crunu agent uses an implementation in Go and is checked against the same test vectors as the browser.
The server only ever sees public keys and sealed ciphertext. Signatures, which X25519 does not provide, come from Ed25519. See how encryption works.
Sources
- RFC 7748: Elliptic Curves for Security, checked October 27, 2026.