Curve25519 design, X25519 design: Daniel J. Bernstein. "Curve25519: new Diffie-Hellman speed records." Pages 207–228 in Public key cryptography—PKC 2006, 9th international conference on theory and practice in public-key cryptography, New York, NY, USA, April 24–26, 2006, proceedings, edited by Moti Yung, Yevgeniy Dodis, Aggelos Kiayias, Tal Malkin, Lecture Notes in Computer Science 3958, Springer, 2006, ISBN 3-540-33851-9. (The 32-bit implementations from that paper are not included in lib25519.) crypto_dh/x25519/ref10: Copied from public-domain supercop/crypto_scalarmult/curve25519/ref10 code by Daniel J. Bernstein. Tweaked in lib25519 to provide crypto_dh instead of crypto_scalarmult (which is done as a separate wrapper in SUPERCOP), and to return void instead of int (these functions never fail in lib25519). crypto_sign/x25519/ref10 is similarly copied from SUPERCOP. SUPERCOP releases: https://bench.cr.yp.to/supercop.html crypto_dh/x25519/donna_c64: Copied from public-domain supercop/crypto_scalarmult/curve25519/donna_c64 code by Adam Langley. Tweaked in lib25519 to provide crypto_dh instead of crypto_scalarmult, and to return void instead of int. crypto_dh/x25519/amd64*: Copied from public-domain supercop/crypto_scalarmult/curve25519/amd64* code by Daniel J. Bernstein, Niels Duif, Tanja Lange, lead: Peter Schwabe, Bo-Yin Yang. Tweaked in lib25519 to provide crypto_dh instead of crypto_scalarmult, to return void instead of int, and to use consts.c (for easy PIC) instead of consts.S. crypto_sign/ed25519/amd64*: Copied from public-domain supercop/crypto_sign/ed25519/amd64* code by Daniel J. Bernstein, Niels Duif, Tanja Lange, lead: Peter Schwabe, Bo-Yin Yang. Tweaked in lib25519 to return void from sign_keypair and sign, to use consts.c instead of consts.S, and to eliminate some compiler warnings (window size 64 in amd64-64-24k/sc25519.h; #ifdef SMALLTABLES around ecd). crypto_dh/x25519/sandy2x: Copied from public-domain supercop/crypto_scalarmult/curve25519/sandy2x code by Tung Chou. Tweaked in lib25519 to provide crypto_dh instead of crypto_scalarmult, to return void instead of int, and to use consts.c instead of consts.S. crypto_sign/ed25519/nath-maa/fe25519_{mul,nsquare}.S: Kaushik Nath and Palash Sarkar, "Efficient arithmetic in (pseudo-)Mersenne prime order fields", Advances in Mathematics of Communications 16 (2022), pages 303–348. Original release: https://github.com/kn-cs/pmp-farith/tree/master/gf-p2-255-19/SL crypto_sign/ed25519/nath-maa/ge25519_base.S: New code in lib25519 from Kaushik Nath. Other ed25519/nath-maa code is from amd64-64-24k. crypto_hash*/sha512/*: Copied from public-domain supercop/crypto_hash*/sha512/* code by Daniel J. Bernstein. Tweaked in lib25519 to have crypto_hash() return void instead of int. lib25519-speed.c: Portions based on public-domain benchmarking software in SUPERCOP by Daniel J. Bernstein. lib25519-test.c: Portions based on public-domain testing software in SUPERCOP by Daniel J. Bernstein. The symmetric-cryptography code in lib25519-test.c for generating pseudorandom test inputs and hashing test outputs is adapted from TweetNaCl, a public-domain library by Daniel J. Bernstein, Wesley Janssen, Tanja Lange, and Peter Schwabe.