# What is the best way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key.

What is the safest −and computationally efficient− way of doing so ?

The community seems unsure whether curve25519 can be used for ECDSA.

It should be safe to authenticate a nonce using a secret-key agreed with ECDH, but wouldn't ECDH itself be enough ? The server sends a one-time use public key, the client returns a hash of the ECDH shared key and the server compares it.

-
1) Authentication always needs to be bound to something. A message or an integrity protected channel. You cannot just authenticate. 2) Your scheme suffers from trivial forwarding attacks where an attacker impersonates the server to learn shared keys. 3) You need to apply some form of MAC, not the key itself. Else an attacker impersonating a server can learn arbitrary shared keys. –  CodesInChaos Feb 12 at 8:47
You should use an existing higher level protocol, like CurveCP. You're not ready yet to design your own protocol. –  CodesInChaos Feb 12 at 8:49
1) It is bound to a tcp connection. If arbitrary data is needed, the server can send a nonce. 2) how about a hash of the shared key ? –  Kai Elvin Feb 12 at 8:52
Also, I do not need encryption in this setting. –  Kai Elvin Feb 12 at 8:54
@KaiElvin : $\:$ Is the client's public key used for anything other than such identification? $\;\;\;\;$ –  Ricky Demer Feb 12 at 8:56