x25519.nx

x25519.nx -- Bernstein's Curve25519 X25519 (RFC 7748). Elliptic-curve Diffie-Hellman on Curve25519 in Montgomery form. Primary classical KEX for TLS 1.3, SSH, Signal, WireGuard, and every modern protocol that cares about correctness. Hybrid- deploys alongside ML-KEM-768 for post-quantum TLS 1.3 (RFC 9578 X25519Kyber768Draft00). Field: GF(p) with p = 2^255 - 19. Curve equation: y^2 = x^3 + 486662*x^2 + x (Montgomery form). Scalar input: 32 bytes, clamped per RFC 7748 §5. u-coordinate input: 32 bytes, high bit cleared per §5. Output: 32-byte shared secret. Representation: 10 x 25.5-bit limbs (Bernstein ref10 style). Offsets: 0, 26, 51, 77, 102, 128, 153, 179, 204, 230 (bits). Limb widths alternate 26 / 25 bits so 10 * 25.5 = 255 bits. Each limb fits in i64 comfortably (26 bits plus headroom). Multiplication of two limbs: 26 + 26 = 52 bits -- well within i64 range. Accumulating up to 10 partial products per output digit: ~56 bits peak -- still within i64. Why 10x25.5 and not 5x51: NishiLang has no u128 / 128-bit multiply. 5x51-bit limbs give 102-bit products that don't fit in i64. The 10x25.5 layout avoids this entirely; every intermediate fits in a plain i64. Constant-time discipline: X25519 MUST run in time independent of scalar/u bits (leaking would recover the private key). The Montgomery ladder + cswap achieves this naturally: same instruction sequence regardless of bit values; conditional swap via bitmask select rather than branch. No table lookups on secret bits. No divisions (used only in fe_invert, which runs over a fixed chain of squarings and multiplications regardless of input). Invariants (enforced, not hoped): XC1 Scalar clamping applied once at entry per RFC 7748 §5: scalar[0] &= 0xf8; scalar[31] &= 0x7f; scalar[31] |= 0x40. XC2 u-coordinate high bit cleared at entry (RFC 7748 §5).