0
$\begingroup$

Is there any known vulnerability or attacks against Curve25519 ?? And pros and cons of using it?

$\endgroup$

2 Answers 2

2
$\begingroup$

Attacks: Of course one can attack the Curve with Brute Force, but that's not very effective. But there are generic discrete logarithms attacks for elliptic curves in general. They can be applied to Curve25519. Examples are Pollard-Rho-attack, Shanks’-Baby-Step-Giant-Step-attack, Pollard-Kangaroo-attack. Here you can find more attacks.

Pros: The main advantage of Curve25519 is the speed (that's also the reason, why the first paper about the curve is called "Curve25519: new Diffie-Hellman speed records"). All parameters are designed to create an extremly fast and efficient key exchange based on elliptic curves. Another important aspect is that one can understand the choice of each parameter by simply reading the paper(This point got very important after Edward Snowdens publications).

Cons: It only provides about 128 Bit security (This number is not fix, it's an approximation). All the other Cons I can think about, are Cons that affect all elliptic curves (e.g. being vulnerable to Shor's quantum computer algorithm).

Hint: If you are interested you can read the main paper and visit this website.

$\endgroup$
3
  • $\begingroup$ any elliptic curve that provide security more than 128 bits? $\endgroup$
    – crypt
    Jun 2, 2021 at 11:12
  • 3
    $\begingroup$ @crypt Curve/Edwards-448, secp384r1, etc. $\endgroup$
    – DannyNiu
    Jun 2, 2021 at 11:36
  • 3
    $\begingroup$ another pro, it is easy to make timing attack resistant implementations, compared to say, a NIST curve, which seem designed to make that VERY hard $\endgroup$ Jun 2, 2021 at 18:09
2
$\begingroup$

Another pro is that the curve is designed to help protecting against side-channel attacks. More precisely, there is a birational equivalence to the Edwards curve $x^2 + y^2 = 1 + dx^2y^2$ with $d = 121665/121666$ as an element in $\mathbb{F}_p$ with $p=2^{255}-19$. Since $d$ is not a square in $\mathbb{F}_p$, the addition law on this curve is 'complete': there is no distinction between formulas for operations such as addition and scalar multiplication etc. This helps in protecting against side-channel attacks. For example, on a Weierstrass model for elliptic curves, one usually distinguishes cases for point addition, which may give an attacker more information on what operation is performed, by looking at the source code.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.