edwards448 is an Edwards curve x² + y² = 1 + dx²y² over a 448-bit prime field with a 446-bit prime-order subgroup and cofactor 4; its estimated security level is 224 bits. Status: recommended for new systems.
Edwards448 is the untwisted Edwards curve x² + y² = 1 − 39081x²y² over p = 2^448 − 2^224 − 1 (RFC 7748 §4.2), 4-isogenous to Curve448. Its group order is 4·n with a 446-bit prime n.
Ed448 (RFC 8032 §5.2) hashes with SHAKE256, uses 57-byte keys and 114-byte signatures, and supports a context string. It is defined for TLS 1.3 (ed448), DNSSEC (algorithm 16), JOSE and COSE (Ed448) and X.509 (OID 1.3.101.113), and FIPS 186-5 approves it.
Names in standards
| Standard | Name |
|---|
| RFC 8032 | edwards448 |
| RFC 8032 / RFC 8410 | Ed448 |
| Hamburg | Goldilocks |
Domain parameters
448-bit prime field · about 224-bit security
- Field prime p
- 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff
- Coefficient d
- 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffff6756
- Base point x
- 0x4f1970c66bed0ded221d15a622bf36da9e146570470f1767ea6de324a3d3a46412ae1af72ab66511433b80e18b00938e2626a82bc70cc05e
- Base point y
- 0x693f46716eb6bc248876203756c9c7624bea73736ca3984087789c1e05a0c2d73ad3ff1ce67c39c4fdbd132c4ed7c8ad9808795bf230fa14
- Order n of the base point
- 0x3fffffffffffffffffffffffffffffffffffffffffffffffffffffff7cca23e9c44edb49aed63690216cc2728dc58f552378c292ab5844f3
- Cofactor h
- 0x4
Used in
- TLS 1.3 (ed448)
- DNSSEC (algorithm 16)
- JOSE (Ed448)
- COSE (Ed448)
Identifiers in registries
← All curves