X25519 derive shared secret
Derive a shared secret from your X25519 private key and a peer's public key (Diffie-Hellman), on your device.
X25519 derive shared secret unwraps two PEM keys, your private key and one peer public key, then runs Diffie-Hellman between them and prints the result as hex. A key wrapped for the wrong curve or type is refused before derivation runs. Either side computes this independently and lands on the same secret, but the tool confirms nothing about the peer.
Questions
What do I need to derive a shared secret?
Your own X25519 private key and the peer's X25519 public key, both PEM, both matching the fixed header from x25519-keygen.
What if a key is for the wrong curve?
It is refused before any derivation happens, naming what was expected.
Does the order of the two keys matter?
No, the same shared value comes out on both ends of the exchange, computed from either side's private key and the other's public key.
Does this confirm who the peer is?
No, it only computes the shared secret from the keys given; nothing here authenticates the peer.
Can I use this from the command line?
Yes, the same code runs on the page, the CLI and MCP.