Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which approach could be regarded to be “the most recommendable” from a safety point of view, while keeping it computationally efficient?

The community seems unsure whether curve25519 can be used for ECDSA. It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.

share|improve this question
1) Authentication always needs to be bound to something. A message or an integrity protected channel. You cannot just authenticate. 2) Your scheme suffers from trivial forwarding attacks where an attacker impersonates the server to learn shared keys. 3) You need to apply some form of MAC, not the key itself. Else an attacker impersonating a server can learn arbitrary shared keys. –  CodesInChaos Feb 12 '14 at 8:47
You should use an existing higher level protocol, like CurveCP. You're not ready yet to design your own protocol. –  CodesInChaos Feb 12 '14 at 8:49
1) It is bound to a tcp connection. If arbitrary data is needed, the server can send a nonce. 2) how about a hash of the shared key ? –  Kai Elvin Feb 12 '14 at 8:52
Also, I do not need encryption in this setting. –  Kai Elvin Feb 12 '14 at 8:54
@KaiElvin : $\:$ Is the client's public key used for anything other than such identification? $\;\;\;\;$ –  Ricky Demer Feb 12 '14 at 8:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.