Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key.

What is the safest −and computationally efficient− way of doing so ?

The community seems unsure whether curve25519 can be used for ECDSA.

It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough ? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.

share|improve this question
    
1) Authentication always needs to be bound to something. A message or an integrity protected channel. You cannot just authenticate. 2) Your scheme suffers from trivial forwarding attacks where an attacker impersonates the server to learn shared keys. 3) You need to apply some form of MAC, not the key itself. Else an attacker impersonating a server can learn arbitrary shared keys. –  CodesInChaos Feb 12 at 8:47
    
You should use an existing higher level protocol, like CurveCP. You're not ready yet to design your own protocol. –  CodesInChaos Feb 12 at 8:49
    
1) It is bound to a tcp connection. If arbitrary data is needed, the server can send a nonce. 2) how about a hash of the shared key ? –  Kai Elvin Feb 12 at 8:52
    
Also, I do not need encryption in this setting. –  Kai Elvin Feb 12 at 8:54
    
@KaiElvin : $\:$ Is the client's public key used for anything other than such identification? $\;\;\;\;$ –  Ricky Demer Feb 12 at 8:56
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.