# Questions tagged [x25519]

Curve25519 is an elliptic curve offering 128 bits of security (256 bits key size) and designed for use with the elliptic curve Diffie–Hellman (ECDH) key agreement scheme.

55 questions
Filter by
Sorted by
Tagged with
2k views

### Distinguishing x25519 public keys from random?

I recently read a piece of protocol that avoided sending ephemeral x25519 keys in the clear as an effort to foil deep-packet inspection. I understand that x25519 public keys are effectively 255 bits, ...
• 779
14k views

### Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
• 651
3k views

### curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
• 562
317 views

### How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
• 213
2k views

### Summarize the mathematical problem at the heart of breaking a Curve25519 public key

It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do: e[0] &= 248 e[31] &= 127 e[31] |= 64 You can then ...
• 217
2k views

### Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://www.rfc-editor.org/rfc/rfc7748 I see that a base point for Curve25519 is ...
• 248
2k views

### How many valid X25519 private keys are there?

According to the Curve25519 website: Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
• 257
509 views

### Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...
• 426
562 views

### "Cropping" the resulting shared secret from ECDH

I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
209 views

### Does any $x < p$ satisfy the curve equation of X25519?

I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
• 1,030
300 views

### Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
• 143
330 views

### Can Curve25519 shared secret be safely truncated to half its size?

I am planning to use a key agreement mechanism in an application needing ephemeral keys, and Curve25519 looks promising, specifically because it offers 128 bits of security, just fine for AES-128 ...
• 1,341
884 views

### Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?

In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys ...
• 185
254 views

### Distinguishing EC Public Key from random

I recently read the post Distinguishing x25519 public keys from random? and found myself wondering why, for a randomly chosen x, the result of the function $$x^3+ax^2+x$$ is a square in 50% of cases ...
380 views

### Isomorphism of Curve25519 and Ed25519?

According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities: What does "birational equivalence" mean in a cryptographic ...
• 2,595
247 views

### How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
• 141
928 views

### Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
• 155
480 views

### Representations of secret keys on Curve25519

https://datatracker.ietf.org/doc/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
• 2,939
3k views

### Why does OpenSSL show 253 bits?

When using ECDHE with Curve25519, OpenSSL shows: Server Temp Key: X25519, 253 bits I thought that, when we use X25519, it uses a 256 bit key. Why does OpenSSL say the server temporary key is 253 ...
2k views

### Composition of X25519+XSalsa20+Poly1305

In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
• 1,434
950 views

### Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
• 65
1k views

### Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
• 33
182 views

### How to distinguish X25519 output from random?

Suppose that Alice has an X25519 key pair $\{S_A,P_A\}$ (secret and public key, respectively). Using randomly selected X25519 public keys $\{P_*\}$ (such that $P_A\notin \{P_*\}$), Alice calculates ...
• 257
127 views

### Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
• 53
352 views

### Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

I'm trying to wrap my head around going from a seed to a SigningKey, and also obtaining a ...
• 107
82 views

### Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
• 402
454 views

### Curve25519 Endianness

According to the original paper form Bernstein public/private keys and the shared symmetric key are stored in little-endian. However, the WolfSSL of WolfSSL supports both, little-endian and big-endian....
• 317
766 views

### Curve25519 Key Exchange Bit Security

Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw. Alice and Bob want to communicate securely over an insecure ...
• 23
410 views

### Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
• 121
457 views

### Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
• 31
89 views

### Are there a way to progress or age key pairs

I am searching for a way to make the noise X pattern fully forward secret. The X pattern is a way to encrypted and authenticated messages. As a building block to achieve this I started pondering if ...
1 vote
1k views

### What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
• 1,387
1 vote
379 views

### Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
1 vote
270 views

### key specifications for x25519 - need two clarifications please

Am implementing x25519 (in 64 bit and 512 bit assembly) following the specifications in RFC 7748 (and its errata list !). Need two clarifications please. The private key is randomly generated 32 ...
• 185
1 vote
194 views

### What scheme is the best for combining two shared secrets?

I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
1 vote
246 views

### Is it safe to derive Ed25519 and Kyber private keys from the same seed?

I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows: Alice sending a file/message to Bob: ...
1 vote
147 views

### Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
1 vote
145 views

### How to most inexpensively extract 1 byte of uniformly distributed entropy from a 32-byte Curve25519 EC point

I'm looking for the simplest and most inexpensive hash with the following properties: Input: A 32-byte Curve25519 EC point containing approximately 125 bits of non-uniformly distributed entropy (...
• 4,740
1 vote
283 views

### JOSE: JWE CEK Initialization Vector Position or Reuse

So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content. My issue however is that NaCl needs an IV (nonce in NaCl) for ...
• 131
1 vote
487 views

### ECDH, x25519 and limitations for securing client-certificates on the server

g'day Crypto.SE I'm working on a practical application of sharing a static key to better-identify a user, between the recipient (server) and the initiator (client ie. user's machine). My core ...
• 318
1 vote
680 views

### Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
• 1,434
1 vote
212 views

### SHA-512 for ECDH key derivation

I'm currently working in a constrained environment and need to derive a symmetric key (that will be used for AES-256 in GCM mode later) based on a low-entropy shared secret obtained via X25519. To ...
• 13
1 vote
191 views

### McCallum-Relyea exchange on x25519 elliptic curve

Background I have a degree in electronics engineering, I'm not bad at programming with many languages, but I'm not that good at cryptography, I'm just able to use that from libraries, and I understand ...
1 vote
47 views

### Is it possible to compute the X25519 scalar multiplication of the SSH key exchange using the ED25519 sliding window implementation?

There are many different ED25519/Curve25519/X25519 implementations around. I focus on two of them: https://github.com/jedisct1/libsodium https://github.com/floodyberry/ed25519-donna The libsodium ...
• 156
1 vote
45 views

### Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between ...
• 346
1 vote
296 views

### Proof of possession of a x25519 private key

In this question one way is shown how to prove the possession of a private x25519 key. Would the following protocol also be suitable to prevent someone from using the client as a decryption Oracle? ...
• 11
1 vote
46 views

### Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
• 4,740
1 vote
267 views

### How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random. My goal is to use the ...
1 vote