Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that Discrete Log is supposed to be hard on curve25519. My questions is whether DDH (Decisional Diffie-Hellman) assumption is conjectured to hold on curve25519 too so that we can use it for building an ElGamal encryption scheme. Some quick investigation shows that DDH are assumed to be hard on elliptic curves with large embedding degree (http://en.wikipedia.org/wiki/Decisional_Diffie%E2%80%93Hellman_assumption) and it seems that most elliptic curves have large embedding degree except those constructed for pairing based crypto. So I guess the answer should be yes. But still I would like to get some expert knowledge to confirm that one can securely build ElGamal encryption on this curve

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.