curve448 is a Montgomery curve By² = x³ + Ax² + x over a 448-bit prime field with a 446-bit prime-order subgroup and cofactor 4; its estimated security level is 224 bits. Status: recommended for new systems.
Curve448 is y² = x³ + 156326x² + x over the 'Goldilocks' prime 2^448 − 2^224 − 1, introduced by Mike Hamburg in 2015 and adopted in RFC 7748. Its group has order 4·n with a 446-bit prime n, for about 224 bits of security.
X448 keys and shared secrets are 56 bytes. TLS 1.3 (x448, marked Recommended by IANA), SSH (curve448-sha512, RFC 8731) and HPKE (DHKEM(X448, HKDF-SHA512)) define it, but it is used far less than X25519. Its Edwards counterpart is edwards448, used for Ed448.
Names in standards
| Standard | Name |
|---|
| RFC 7748 | curve448 |
| RFC 7748 / RFC 8410 | X448 |
Domain parameters
448-bit prime field · about 224-bit security
- Field prime p
- 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff
- Coefficient a
- 0x262a6
- Coefficient b
- 0x1
- Base point x
- 0x5
- Base point y
- 0x7d235d1295f5b1f66c98ab6e58326fcecbae5d34f55545d060f75dc28df3f6edb8027e2346430d211312c4b150677af76fd7223d457b5b1a
- Order n of the base point
- 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffff7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3
- Cofactor h
- 0x4
Used in
- TLS 1.3 (x448)
- SSH (curve448-sha512)
- HPKE
Identifiers in registries
← All curves