A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key.
What is the safest −and computationally efficient− way of doing so ?
The community seems unsure whether curve25519 can be used for ECDSA.
It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough ? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.