Questions tagged [x25519]

Curve25519 is an elliptic curve offering 128 bits of security (256 bits key size) and designed for use with the elliptic curve Diffie–Hellman (ECDH) key agreement scheme.

Filter by
Sorted by
Tagged with
4 votes
1 answer
248 views

Distinguishing EC Public Key from random

I recently read the post Distinguishing x25519 public keys from random? and found myself wondering why, for a randomly chosen x, the result of the function $$x^3+ax^2+x$$ is a square in 50% of cases ...
10 votes
2 answers
2k views

Summarize the mathematical problem at the heart of breaking a Curve25519 public key

It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do: e[0] &= 248 e[31] &= 127 e[31] |= 64 You can then ...
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1 vote
2 answers
127 views

SHA-512 for ECDH key derivation

I'm currently working in a constrained environment and need to derive a symmetric key (that will be used for AES-256 in GCM mode later) based on a low-entropy shared secret obtained via X25519. To ...
1 vote
2 answers
164 views

What scheme is the best for combining two shared secrets?

I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
2 votes
1 answer
754 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
1 vote
1 answer
166 views

Is it safe to derive Ed25519 and Kyber private keys from the same seed?

I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows: Alice sending a file/message to Bob: ...
0 votes
0 answers
102 views

A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret

Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key? ...
4 votes
1 answer
245 views

How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
1 vote
0 answers
41 views

Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between ...
1 vote
1 answer
163 views

McCallum-Relyea exchange on x25519 elliptic curve

Background I have a degree in electronics engineering, I'm not bad at programming with many languages, but I'm not that good at cryptography, I'm just able to use that from libraries, and I understand ...
3 votes
2 answers
172 views

How to distinguish X25519 output from random?

Suppose that Alice has an X25519 key pair $\{S_A,P_A\}$ (secret and public key, respectively). Using randomly selected X25519 public keys $\{P_*\}$ (such that $P_A\notin \{P_*\}$), Alice calculates ...
9 votes
2 answers
2k views

How many valid X25519 private keys are there?

According to the Curve25519 website: Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
6 votes
2 answers
483 views

"Cropping" the resulting shared secret from ECDH

I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
0 votes
0 answers
158 views

Fast methods for adding the basepoint to an elliptic curve point?

Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates? I.e. if G is ...
2 votes
1 answer
378 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
4 votes
2 answers
341 views

Isomorphism of Curve25519 and Ed25519?

According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities: What does "birational equivalence" mean in a cryptographic ...
3 votes
1 answer
2k views

Why does OpenSSL show 253 bits?

When using ECDHE with Curve25519, OpenSSL shows: Server Temp Key: X25519, 253 bits I thought that, when we use X25519, it uses a 256 bit key. Why does OpenSSL say the server temporary key is 253 ...
0 votes
1 answer
57 views

Can X25519 (mult with basepoint) be reversed?

I admit I don't know a lot about the math behind Curve25519 and the DH exchange based on it. I'm asking if after publishing the result of this operation: ...
3 votes
1 answer
2k views

Composition of X25519+XSalsa20+Poly1305

In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
3 votes
1 answer
901 views

Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
1 vote
0 answers
241 views

Proof of possession of a x25519 private key

In this question one way is shown how to prove the possession of a private x25519 key. Would the following protocol also be suitable to prevent someone from using the client as a decryption Oracle? ...
1 vote
1 answer
851 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
1 vote
1 answer
133 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
3 votes
1 answer
1k views

Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
1 vote
1 answer
139 views

How to most inexpensively extract 1 byte of uniformly distributed entropy from a 32-byte Curve25519 EC point

I'm looking for the simplest and most inexpensive hash with the following properties: Input: A 32-byte Curve25519 EC point containing approximately 125 bits of non-uniformly distributed entropy (...
1 vote
0 answers
45 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
2 votes
2 answers
305 views

Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

I'm trying to wrap my head around going from a seed to a SigningKey, and also obtaining a ...
0 votes
1 answer
88 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
1 vote
0 answers
257 views

How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random. My goal is to use the ...
2 votes
1 answer
424 views

Curve25519 Endianness

According to the original paper form Bernstein public/private keys and the shared symmetric key are stored in little-endian. However, the WolfSSL of WolfSSL supports both, little-endian and big-endian....
2 votes
1 answer
421 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
2 votes
1 answer
80 views

Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
11 votes
1 answer
2k views

curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
1 vote
0 answers
94 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
1 vote
1 answer
252 views

JOSE: JWE CEK Initialization Vector Position or Reuse

So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content. My issue however is that NaCl needs an IV (nonce in NaCl) for ...
0 votes
1 answer
76 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
1 vote
1 answer
446 views

ECDH, x25519 and limitations for securing client-certificates on the server

g'day Crypto.SE I'm working on a practical application of sharing a static key to better-identify a user, between the recipient (server) and the initiator (client ie. user's machine). My core ...
1 vote
1 answer
361 views

Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
6 votes
1 answer
203 views

Does any $x < p$ satisfy the curve equation of X25519?

I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
10 votes
3 answers
2k views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://www.rfc-editor.org/rfc/rfc7748 I see that a base point for Curve25519 is ...
3 votes
0 answers
121 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
6 votes
0 answers
283 views

Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
1 vote
1 answer
630 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
0 votes
1 answer
698 views

Explaining modulo reduction of curve25519, multiply hi bits with 38 trick?

I have learnt that there is a trick where you can speed up the reduction modulo of a point (x-value) in a x25519 curve. Since, it uses the prime number $2^{255} - 19$. From article: Reduction ...
1 vote
1 answer
252 views

key specifications for x25519 - need two clarifications please

Am implementing x25519 (in 64 bit and 512 bit assembly) following the specifications in RFC 7748 (and its errata list !). Need two clarifications please. The private key is randomly generated 32 ...
4 votes
2 answers
855 views

Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?

In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys ...
3 votes
1 answer
473 views

Representations of secret keys on Curve25519

https://datatracker.ietf.org/doc/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
2 votes
0 answers
84 views

Are there a way to progress or age key pairs

I am searching for a way to make the noise X pattern fully forward secret. The X pattern is a way to encrypted and authenticated messages. As a building block to achieve this I started pondering if ...
6 votes
2 answers
488 views

Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...