A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which approach could be regarded to be “the most recommendable” from a safety point of view, while keeping it computationally efficient?
The community seems unsure whether curve25519 can be used for ECDSA. It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.