1
$\begingroup$

I'm working in the Curve25519 domain (EC curve, 256-bit key size). I have a peer pubkey, and need to send it an encrypted message.

For starters we create a "nonce" (ephemeral key), and use it to derive a DH shared secret. Then it's usually used to initialize a symmetric key (i.e. AES or similar) to encrypt the actual message. But my message is only 256-bit size (yet another key), and I don't need things like HMAC. So I thought about just XOR-ing the key with the shared secret.

Is this scheme good enough?

If I'm not mistaken, the DH shared secret is actually an X-coordinate of the EC point (in affine coordinates). And, strictly speaking, not all values are possible (little less than half actually). But this seems to be a minor consideration.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Some observations:

  1. Curve25519 is only 255 bits effective. The top bit is always 0, so you leak 1 bit of secret.

  2. Elliptic-curve point coordinate is not uniformly distributed, which means there's bias when XOR with the cipher transcript.

Improve this answer
$\endgroup$
6
  • $\begingroup$ Did you forget that 3 bits are zeroed? $\endgroup$
    – kelalaka
    Commented Jul 4 at 19:14
  • $\begingroup$ Running the shared secret through a hash function like SHA-256 first should fix both of those issues, right? $\endgroup$
    – n-l-i
    Commented Jul 4 at 19:17
  • $\begingroup$ @n-l-i ECDH security when no KDF is used $\endgroup$
    – kelalaka
    Commented Jul 4 at 19:30
  • $\begingroup$ @kelalaka the 3 cleared bits are that of the private key, i.e. the scalar. Which means there's still a brutal-force complexity of more than 128 bits. $\endgroup$
    – DannyNiu
    Commented Jul 5 at 1:09
  • $\begingroup$ Pollard's lambda for range queries? $\endgroup$
    – kelalaka
    Commented Jul 5 at 8:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.