# Proof of possession of a x25519 private key

In this question one way is shown how to prove the possession of a private x25519 key. Would the following protocol also be suitable to prevent someone from using the client as a decryption Oracle?

1. Server generates some 'nonce' and an ephemeral x25519 key pair. The sever sends the nonce and the public x25519 key to the client.
2. The client derives with his private x25519 key and the public x25519 key of the server a shared key. The client signs the nonce with HMAC using the shared key. The client sends the signature to the server.
3. The server derives the shared key and validates the HMAC signature.
• What is wrong with a good old discrete-log zero-knowledge proof? E.g. for private key $x$, Prover publishes $Y=G^x$, then samples an integer $x'$ computes $T=G^{x'}$, then computes $c = hash(G, Y, T)$ and sends $c, -cx+x'$. Verifier reconstructs $T$ by doing $G^{-cx+x'}Y^c$, and checking that $c = hash(G, Y, T)$. May 20, 2022 at 14:37
• You're already going to need to do something to prevent man-in-the-middle attacks that will involve signatures to prove the server's identity to the client. So why not just use that same mechanism to prove the client's identity to the server? May 20, 2022 at 14:49
• @zugzwang Thank you for your idea. But i think one problem is that $-cx+x'$ is not "clamped". If for example libsodium is used, you cannot use standard functions May 20, 2022 at 20:32
• Just for the record, my idea is not original at all. It is the basic zk proof of knowledge (if you want to see nice extensions, I encourage you to check the Camenisch-Stadler 97 paper). Now, this argument applies to any group. In particular, to Curve25519. The clamping is only an implementation trick to avoid the small subgroup of order 8. So of course this argument works in Curve 25519. The elegance of it is that it depends only on ECDLP, instead of signing algorithms such as Ed25519. May 21, 2022 at 9:34
• @knaccc Good idea. Thank you. May 23, 2022 at 5:38