I'm having trouble understanding what the “security model” for “scalar multiplication” in NaCl is.
Security model
crypto_scalarmult
is designed to be strong as a component of various well-known "hashed Diffie–Hellman" applications. In particular, it is designed to make the "computational Diffie–Hellman" problem (CDH) difficult with respect to the standard base.
crypto_scalarmult
is also designed to make CDH difficult with respect to other nontrivial bases. In particular, if a represented group element has small order, then it is annihilated by all represented scalars. This feature allows protocols to avoid validating membership in the subgroup generated by the standard base.NaCl does not make any promises regarding the "decisional Diffie–Hellman" problem (DDH), the "static Diffie–Hellman" problem (SDH), etc. Users are responsible for hashing group elements.
Since “crypto_scalarmult
is the function crypto_scalarmult_curve25519
”, does this mean that Curve25519 does not provide any guarantees for the DDH problem to be hard?
If so, how can one—as suggested—hash group elements to achieve this? E.g., how does one implement elliptic curve El-Gamal in a semantically secure way using this implementation, if possible at all?