Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

DJB described curve25519 in his paper which can be found here (PDF). It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that Discrete Log is supposed to be hard on curve25519.

My questions is whether DDH (Decisional Diffie-Hellman) assumption is conjectured to hold on curve25519 too so that we can use it for building an ElGamal encryption scheme. Some quick investigation shows that DDH are assumed to be hard on elliptic curves with large embedding degree (Wikipedia – Decisional Diffie–Hellman assumption) and it seems that most elliptic curves have large embedding degree except those constructed for pairing based crypto.

So, I guess the answer should be “yes”. But still I would like to get some expert knowledge to confirm that one can securely build ElGamal encryption on this curve.

share|improve this question

marked as duplicate by e-sushi, CodesInChaos, Gilles, cygnusv, DrLecter Jun 29 '15 at 15:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Curve25519 was supposed to be mainly used for Diffie-Hellman key-exchange and it provides ~128bit security and should fulfill all standard security assumptions on elliptic curves (and even some more).

Now to answer the question is: yes.
ElGamal can be used securely with Curve25519, as ElGamal is simply a Diffie-Hellman key-exchange ($\delta= m*g^{\alpha k}$) using some message-specific private key $k$ which is transmitted via $\gamma = g^k$.
This means one either has to break the Diffie-Hellman problem (which is hard on Curve25519) or break the discrete-logarithm problem on Curve25519, which is equally hard (as it would enable you to break the Diffie-Hellman problem)

However I'd strongly recommend against using plain (or even padded) ElGamal in production use. If you intend to use elliptic curves for message encryption and signature I strongly recommend you to either use EdDSA or ECIES.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.