Acceleration of Curve25519 Field Operations with Java Software and Intrinsics

There have been a number of enhancements in JDK 27 and JDK 28 that have significantly increased the performance of Curve25519 field operations, which is the foundation for X25519 [1] key generation and agreement, the Ed25519 [2] signature scheme, and the X25519MLKEM768 [3,9] post-quantum hybrid key exchange group for TLS 1.3.
Applications will see these performance improvements when using these algorithms with the JCE APIs KeyAgreement, Signature , KeyPairGenerator and with the JSSE APIs when using TLS 1.3 Hybrid Key Exchange.

Improved Performance of Curve25519 Field Operations

Software changes increased the size of internal data structures, enabling more efficient computations. As a result, the following algorithms will show noticeable gains in performance starting in JDK 27 - build 14:

• X25519 [4,5] key generation and key agreement: 49-54% throughput increase

• Ed25519 [6,7] key generation, signing, and verification: 46-49% throughput increase

• X25519MLKEM768 [8] key generation and hybrid key exchange: 27-51% throughput increase

In addition to software efficiencies, intrinsics were created for both x86_64 and AArch64 architectures. These intrinsics build on the software improvements and use optimized architecture-specific machine instructions. As a result, substantial performance gains were observed from the following platforms, starting in JDK 28 (build 5):

• x86_64

  • X25519 key generation and key agreement: 19% throughput increase

  • Ed25519 key generation, signing, and verification: 16-20% throughput increase

  • X25519MLKEM768 key generation and hybrid key exchange: 12-15% throughput increase

• AArch64

  • X25519 key generation and agreement: 7-10% throughput increase

  • Ed25519 key generation, signing, and verification: 12-15% throughput increase

  • X25519MLKEM768 key generation and hybrid key exchange: 7-8% throughput increase

Next Steps

With JDK 27 and JDK 28 early-access builds, applications will observe significant performance gains with Curve25519 field operations through the X25519, Ed25519, and X25519MLKEM768 algorithms. We encourage you to download the early-access builds of JDK 27 and JDK 28, try these improvements, and share your feedback through the security-dev OpenJDK mailing list (registration required).

References

[1] X25519 is a key agreement function that uses Curve25519, as specified in RFC 7748

[2] Ed25519 is a signature algorithm that is based on Curve25519, as specified in RFC 8032

[3] X25519MLKEM768 is a post-quantum hybrid key exchange scheme specified in RFC 10024

[4] Benchmark: micro:org.openjdk.bench.javax.crypto.full.KEMBench.JSSE_DHasKEM

[5] Benchmark: micro:org.openjdk.bench.javax.crypto.full.KeyAgreementBench.XDH

[6] Benchmark: micro:org.openjdk.bench.javax.crypto.full.KeyPairGeneratorBench.EdDSA

[7] Benchmark: micro:org.openjdk.bench.javax.crypto.full.SignatureBench.EdDSA

[8] Benchmark: micro:org.openjdk.bench.java.security.SSLHandshake

[9] JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3