2
$\begingroup$

When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema. I know, that Curve25519 has a pretty fast arithmetic, so my first idea was, that it is used to decrease the server load. Am i right with my idea? Can someone give me a better answer?

Edit: I understand that my question may be not clear enough: Why is it not used for encryption/decryption of messages, when used in messenger like Threema?

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ Side-channel resistance due to the Montgomery ladder? $\endgroup$
    – kelalaka
    Commented Mar 27, 2020 at 11:58
  • $\begingroup$ That still does not answer the question, y it is not used for the encryption itself. $\endgroup$
    – Titanlord
    Commented Mar 27, 2020 at 12:02
  • $\begingroup$ What would you expect the curve to be used for? $\endgroup$
    – Aman Grewal
    Commented Mar 27, 2020 at 12:11
  • $\begingroup$ Encryption and Decryption, too. I know, that there is Elgamal on short Weierstraß equations, so i thought is would be able to use it on Curve25519 too. $\endgroup$
    – Titanlord
    Commented Mar 27, 2020 at 12:15
  • 1
    $\begingroup$ Have you ever heard hybrid Cryptosystem, and do you know that embedding plaintext is not perfect in ECC? $\endgroup$
    – kelalaka
    Commented Mar 27, 2020 at 12:32

2 Answers 2

Reset to default
3
$\begingroup$

A number of reasons contribute to this.

Curve25519 has a non-governmental origin.

It's a curve that's very safe by design, and impregnable to many side-channel and other weaknesses that other curves suffer from.

Also, it's a curve with 'nothing up my sleeve' coefficients.

Unlike the NSA curves, which NIST endorse.

Although not directly related, after the backdoor in Dual_EC_DRBG had been exposed, suspicious aspects of the NIST's P curve constants led to concerns that the NSA had chosen values that gave them an advantage in finding private keys. Since then, many protocols and programs started to use Curve25519 as an alternative to NIST P-256 curve.

As Kelalaka states, the constant time scalar multiplication provided by the Montgomery ladder is also pretty cool.

You cannot directly encrypt arbitrary amounts of data direct with elliptic curves.

The public key is a point on the curve and the private key is a number.

There isn't an elegant mechanism to directly encrypt (generalised ElGamal notwithstanding).

That's why key agreement revolves around finding a shared point on the curve and using a digest of the x co-ordinate of that shared point to use with a fast, secure symmetric cipher.

Improve this answer
$\endgroup$
4
  • $\begingroup$ @Titanlord, updated my answer $\endgroup$
    – Woodstock
    Commented Mar 27, 2020 at 12:35
  • $\begingroup$ "Curve25519 has quite a 'cipher-punk' origin." Probably should be removed. Or describe the origin in less vague terms. Some people see "cypherpunk" with positive connotations (activists and advocates). Others have negative connotations (sloppy coding, foot dragging when warned about vulnerabilities, amateur hubris, mailing list people). Curve25519's technical merits are really impressive. I don't think it's origin amounts to much compared to those merits. It's plausible, too, that the origin could have slowed its initial adoption. $\endgroup$
    – Future Security
    Commented Mar 28, 2020 at 23:37
  • $\begingroup$ (I don't have an opinion about what cypherpunk means. I bet that if you had a debate over the meaning with a large enough group of people, then you'd almost immediately enter no-true-Scotsman territory and not get anywhere. DJB is a pretty great activist and algorithm designer, though, regardless of whether he's considered cypherpunk or who else is considered cypherpunk.) $\endgroup$
    – Future Security
    Commented Mar 28, 2020 at 23:46
  • $\begingroup$ Agreed and updated. $\endgroup$
    – Woodstock
    Commented Mar 29, 2020 at 13:43
1
$\begingroup$

In general, asymmetric cryptography (which includes elliptic curve crypto, RSA, Diffie-Hellman, etc) is orders of magnitude slower than symmetric cryptography (e.g., AES). Curve 25519 is fast compared to other asymmetric cryptography, but still very slow compared to symmetric encryption.

Because of this, asymmetric cryptography is mostly used to set up symmetric keys for further use in symmetric cryptography (key exchange, hybrid encryption, etc), or for electronic signatures (where it is applied to a hash of a document/message, and not the full document/message, for the same inefficiency reason).

Thus you expect asymmetric cryptography (and as a side effect, Curve 25519) in contexts such as:

The list is far from exhaustive, but should give you an idea where to look.

So I think that the question to your answer is that it is not specific to Curve 25519 at all -- you could probably observe the same for any asymmetric cryptographic scheme: messages are likely to be encrypted using a symmetric cipher such as AES for efficiency, and the key for that is set up using key exchange or inside the hybrid encryption, for which Curve 25519 might be used.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Is message expansion in general a disadvantage of assymetric system, too? $\endgroup$
    – Titanlord
    Commented Mar 28, 2020 at 9:32
  • $\begingroup$ I think this is a minor issue compared to the other points. It depends a lot on the exact properties you want. $\endgroup$
    – user4621
    Commented Mar 28, 2020 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.