In this question one way is shown how to prove the possession of a private x25519 key. Would the following protocol also be suitable to prevent someone from using the client as a decryption Oracle?
- Server generates some 'nonce' and an ephemeral x25519 key pair. The sever sends the nonce and the public x25519 key to the client.
- The client derives with his private x25519 key and the public x25519 key of the server a shared key. The client signs the nonce with HMAC using the shared key. The client sends the signature to the server.
- The server derives the shared key and validates the HMAC signature.