X25519(k, u) runs a constant-time Montgomery ladder on u-coordinates only. A private key is 32 random bytes that the function clamps (clearing the three low bits and bit 255, setting bit 254); the public key is X25519(k, 9) (RFC 7748 §5). Because the curve and its twist are both safe, any 32-byte string can be used as a peer key without point validation, but low-order inputs produce an all-zero shared secret, which protocols should detect and reject (RFC 7748 §6.1).
Identifiers: TLS supported group x25519 (29, 0x001D); SSH curve25519-sha256 (RFC 8731); OID 1.3.101.110 (RFC 8410); JOSE ECDH-ES with an OKP key and crv X25519 (RFC 8037); HPKE DHKEM(X25519, HKDF-SHA256), KEM id 0x0020 (RFC 9180). OpenSSL 3.6.5 computes about 52,000 X25519 operations per second on one Apple M4 Max core.
X25519 is key agreement, not a signature: Ed25519 signs. The two share a curve and keys can be mapped between forms, but using one key for both purposes is discouraged. Shor's algorithm breaks X25519, so TLS now pairs it with ML-KEM-768 in the hybrid group X25519MLKEM768 (0x11EC, RFC 10024), and OpenSSH defaults to mlkem768x25519-sha256.