Hardware-based security for high-level protection.

XIP4001C: X25519

Curve25519 Key Exchange IP Core


XIP4001C from Xiphera is a very compact Intellectual Property (IP) core designed for efficient key exchange using the X25519 protocol. XIP4001C implements arithmetic on Curve25519 [1], and provides a security level of 128 bits. Curve25519 is used in numerous contemporary security protocols and applications, including TLS 1.3.

XIP4001C has been designed for easy integration with FPGA- and ASIC-based designs in a vendor-agnostic design methodology, and the functionality of XIP4001C does not rely on any FPGA manufacturer-specific features.

Key features

  • Minimal Resource Requirements: The entire XIP4001C requires less than 1k Logic Elements and uses only 1-2 multipliers/DSP Blocks [2] and one internal memory block in a typical FPGA implementation.
  • Constant Latency: The execution time of XIP4001C is independent of the key value, and consequently provides protection against timing-based side-channel attacks.
  • Performance: Despite its small size, XIP4001C can support more than 100 key exchange operations per second.
  • Standard Compliance: XIP4001C is compliant with RFC7748, and can be used as a part of many public-key protocols including IKEv2 (RFC 8031) and TLS 1.3 (RFC 8446).


XIP4001C calculates the operation Qₓ = sPₓ using the Montgomery Ladder Algorithm, where

  • Pₓ is the 255 bits long input argument
  • s is the secret key (32 bytes long)
  • Qₓ is the 255 bits long point multiplication result

The internal word width as well as the bus widths for din and dout is set to 17 bits, as this leads to an efficient internal implementation [3] of the multiplication algorithm.

For more technical and commercial details, including FPGA resources & peak performance as well as ordering instructions, open the full product brief in PDF. Contact us by sending and email to email_career.png, and we’ll get back to you as soon as possible.

Open full product brief

Block diagram

Figure 1: Internal high-level block diagram of XIP4001C

Figure 1: Internal high-level block diagram of XIP4001C


[1] Curve25519 is formally defined as y² = x³ + 486662x² + x over the finite field defined by the prime number 2²⁵⁵ − 19.

[2] The exact number depends on the targeted FPGA architecture.

[3] 15 · 17 bits = 255 bits.

Visit the product family page