# Curve25519 simple key exchange approach

What is a simple approach in Curve25519 key exchange in basic steps?

• Have you looked at cr.yp.to/ecdh.html ? What's not clear in it ? – Ruggero Mar 12 '18 at 16:18

1. Alice and Bob choose their secret scalars $a,b \in \{0,1\}^{|p|}$.

2. They compute their public keys $Ga$ and $Gb$ and send the public key to the other.

3. Alice computes the shared key $k = \text{kdf}(Gba)$ and Bob computes the shared key $k = \text{kdf}(Gab)$.

1. They can use this established key $k$ as their shared symmetric key. I.e. Use it as the key for AES-PMAC-SIV to send variable-length messages that are both authenticated end encrypted.

Eve is allowed to learn all public keys and ciphertexts. Assuming that at least the Computation Diffie-Hellman and Discrete Logarithm problems are hard, then she cannot recover the shared key.

• Careful! The secret scalars are not arbitrary 256-bit strings, or arbitrary 253-bit strings if $p$ is the order of the standard base point and $|p| = \lceil\log_2 p\rceil$; they are rather multiples of 8 between $2^{254}$ and $2^{255}$. Not clear on your notation $Ga$; is this supposed to be the scalar multiplication of the base point $G$ by the scalar $a$? If so, why the half-multiplicative half-exponential notation $Gb^a$? – Squeamish Ossifrage Mar 12 '18 at 15:38
• Er I mixed notations indeed. Editing. Thanks for pointing that out – cypherfox Mar 12 '18 at 15:45
• As for the scalar point details I'd rather not assume clamping and cofactors. See Decaf/Ristretto. Ideally the scalar is the full 256-bit. – cypherfox Mar 12 '18 at 15:47
• You can choose to use Decaf or Ristretto, but most applications of Curve25519 don't. If you want to call the uniform random 256-bit string the private key, that's fine; it's just not the scalar that is used in practice. – Squeamish Ossifrage Mar 12 '18 at 15:50
• Okay. Should I say $F^*_p$ too? – cypherfox Mar 12 '18 at 15:58