What is a simple approach in Curve25519 key exchange in basic steps?
0
$\begingroup$
$\endgroup$
-
$\begingroup$ Have you looked at cr.yp.to/ecdh.html ? What's not clear in it ? $\endgroup$ – Ruggero Mar 12 '18 at 16:18
1
$\begingroup$
$\endgroup$
Alice and Bob choose their secret scalars $a,b \in \{0,1\}^{|p|}$.
They compute their public keys $Ga$ and $Gb$ and send the public key to the other.
Alice computes the shared key $k = \text{kdf}(Gba)$ and Bob computes the shared key $k = \text{kdf}(Gab)$.
- They can use this established key $k$ as their shared symmetric key. I.e. Use it as the key for AES-PMAC-SIV to send variable-length messages that are both authenticated end encrypted.
Eve is allowed to learn all public keys and ciphertexts. Assuming that at least the Computation Diffie-Hellman and Discrete Logarithm problems are hard, then she cannot recover the shared key.
-
$\begingroup$ Careful! The secret scalars are not arbitrary 256-bit strings, or arbitrary 253-bit strings if $p$ is the order of the standard base point and $|p| = \lceil\log_2 p\rceil$; they are rather multiples of 8 between $2^{254}$ and $2^{255}$. Not clear on your notation $Ga$; is this supposed to be the scalar multiplication of the base point $G$ by the scalar $a$? If so, why the half-multiplicative half-exponential notation $Gb^a$? $\endgroup$ – Squeamish Ossifrage Mar 12 '18 at 15:38
-
$\begingroup$ Er I mixed notations indeed. Editing. Thanks for pointing that out $\endgroup$ – cypherfox Mar 12 '18 at 15:45
-
$\begingroup$ As for the scalar point details I'd rather not assume clamping and cofactors. See Decaf/Ristretto. Ideally the scalar is the full 256-bit. $\endgroup$ – cypherfox Mar 12 '18 at 15:47
-
$\begingroup$ You can choose to use Decaf or Ristretto, but most applications of Curve25519 don't. If you want to call the uniform random 256-bit string the private key, that's fine; it's just not the scalar that is used in practice. $\endgroup$ – Squeamish Ossifrage Mar 12 '18 at 15:50
-
