0
$\begingroup$

What is a simple approach in Curve25519 key exchange in basic steps?

|improve this question
$\endgroup$
  • $\begingroup$ Have you looked at cr.yp.to/ecdh.html ? What's not clear in it ? $\endgroup$ – Ruggero Mar 12 '18 at 16:18
1
$\begingroup$

  1. Alice and Bob choose their secret scalars $a,b \in \{0,1\}^{|p|}$.

  2. They compute their public keys $Ga$ and $Gb$ and send the public key to the other.

  3. Alice computes the shared key $k = \text{kdf}(Gba)$ and Bob computes the shared key $k = \text{kdf}(Gab)$.

  1. They can use this established key $k$ as their shared symmetric key. I.e. Use it as the key for AES-PMAC-SIV to send variable-length messages that are both authenticated end encrypted.

Eve is allowed to learn all public keys and ciphertexts. Assuming that at least the Computation Diffie-Hellman and Discrete Logarithm problems are hard, then she cannot recover the shared key.

|improve this answer
$\endgroup$
  • $\begingroup$ Careful! The secret scalars are not arbitrary 256-bit strings, or arbitrary 253-bit strings if $p$ is the order of the standard base point and $|p| = \lceil\log_2 p\rceil$; they are rather multiples of 8 between $2^{254}$ and $2^{255}$. Not clear on your notation $Ga$; is this supposed to be the scalar multiplication of the base point $G$ by the scalar $a$? If so, why the half-multiplicative half-exponential notation $Gb^a$? $\endgroup$ – Squeamish Ossifrage Mar 12 '18 at 15:38
  • $\begingroup$ Er I mixed notations indeed. Editing. Thanks for pointing that out $\endgroup$ – cypherfox Mar 12 '18 at 15:45
  • $\begingroup$ As for the scalar point details I'd rather not assume clamping and cofactors. See Decaf/Ristretto. Ideally the scalar is the full 256-bit. $\endgroup$ – cypherfox Mar 12 '18 at 15:47
  • $\begingroup$ You can choose to use Decaf or Ristretto, but most applications of Curve25519 don't. If you want to call the uniform random 256-bit string the private key, that's fine; it's just not the scalar that is used in practice. $\endgroup$ – Squeamish Ossifrage Mar 12 '18 at 15:50
  • $\begingroup$ Okay. Should I say $F^*_p$ too? $\endgroup$ – cypherfox Mar 12 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.