Questions tagged [x25519]

Curve25519 is an elliptic curve offering 128 bits of security (256 bits key size) and designed for use with the elliptic curve Diffie–Hellman (ECDH) key agreement scheme.

Filter by
Sorted by
Tagged with
23 votes
1 answer
2k views

Distinguishing x25519 public keys from random?

I recently read a piece of protocol that avoided sending ephemeral x25519 keys in the clear as an effort to foil deep-packet inspection. I understand that x25519 public keys are effectively 255 bits, ...
Jonas's user avatar
  • 779
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
ams's user avatar
  • 631
11 votes
1 answer
2k views

curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
Perseids's user avatar
  • 562
11 votes
1 answer
315 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
Cookies's user avatar
  • 213
10 votes
2 answers
2k views

Summarize the mathematical problem at the heart of breaking a Curve25519 public key

It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do: e[0] &= 248 e[31] &= 127 e[31] |= 64 You can then ...
Kevin Burke's user avatar
10 votes
3 answers
2k views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://www.rfc-editor.org/rfc/rfc7748 I see that a base point for Curve25519 is ...
sribin's user avatar
  • 248
9 votes
2 answers
2k views

How many valid X25519 private keys are there?

According to the Curve25519 website: Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
Ben Zelnick's user avatar
7 votes
2 answers
507 views

Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...
Pierre's user avatar
  • 426
6 votes
2 answers
509 views

"Cropping" the resulting shared secret from ECDH

I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
user avatar
6 votes
1 answer
208 views

Does any $x < p$ satisfy the curve equation of X25519?

I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
Aravind A's user avatar
  • 1,020
6 votes
0 answers
287 views

Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
Bob Semple's user avatar
4 votes
2 answers
865 views

Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?

In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys ...
ustulation's user avatar
4 votes
1 answer
253 views

Distinguishing EC Public Key from random

I recently read the post Distinguishing x25519 public keys from random? and found myself wondering why, for a randomly chosen x, the result of the function $$x^3+ax^2+x$$ is a square in 50% of cases ...
Safari1811's user avatar
4 votes
2 answers
357 views

Isomorphism of Curve25519 and Ed25519?

According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities: What does "birational equivalence" mean in a cryptographic ...
Myria's user avatar
  • 2,575
4 votes
1 answer
246 views

How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
Việt Dũng Lê's user avatar
3 votes
1 answer
908 views

Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
Z0OM's user avatar
  • 155
3 votes
1 answer
477 views

Representations of secret keys on Curve25519

https://datatracker.ietf.org/doc/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
neubert's user avatar
  • 2,927
3 votes
1 answer
2k views

Why does OpenSSL show 253 bits?

When using ECDHE with Curve25519, OpenSSL shows: Server Temp Key: X25519, 253 bits I thought that, when we use X25519, it uses a 256 bit key. Why does OpenSSL say the server temporary key is 253 ...
M K Saravanan's user avatar
3 votes
1 answer
2k views

Composition of X25519+XSalsa20+Poly1305

In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
Woodstock's user avatar
  • 1,394
3 votes
1 answer
1k views

Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
jjd's user avatar
  • 33
3 votes
2 answers
177 views

How to distinguish X25519 output from random?

Suppose that Alice has an X25519 key pair $\{S_A,P_A\}$ (secret and public key, respectively). Using randomly selected X25519 public keys $\{P_*\}$ (such that $P_A\notin \{P_*\}$), Alice calculates ...
Ben Zelnick's user avatar
3 votes
0 answers
122 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
Kri Noe's user avatar
  • 53
2 votes
2 answers
324 views

Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

I'm trying to wrap my head around going from a seed to a SigningKey, and also obtaining a ...
mkl's user avatar
  • 107
2 votes
1 answer
818 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
FooBar's user avatar
  • 45
2 votes
1 answer
81 views

Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
TonyK's user avatar
  • 402
2 votes
1 answer
437 views

Curve25519 Endianness

According to the original paper form Bernstein public/private keys and the shared symmetric key are stored in little-endian. However, the WolfSSL of WolfSSL supports both, little-endian and big-endian....
Marc's user avatar
  • 307
2 votes
2 answers
741 views

Curve25519 Key Exchange Bit Security

Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw. Alice and Bob want to communicate securely over an insecure ...
kping0's user avatar
  • 23
2 votes
1 answer
389 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
shotex's user avatar
  • 121
2 votes
1 answer
440 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
Si Bxxx's user avatar
  • 31
2 votes
0 answers
85 views

Are there a way to progress or age key pairs

I am searching for a way to make the noise X pattern fully forward secret. The X pattern is a way to encrypted and authenticated messages. As a building block to achieve this I started pondering if ...
Håkan Olsson's user avatar
1 vote
1 answer
898 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
RocketNuts's user avatar
  • 1,387
1 vote
1 answer
367 views

Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
Alexander Smirnov's user avatar
1 vote
1 answer
257 views

key specifications for x25519 - need two clarifications please

Am implementing x25519 (in 64 bit and 512 bit assembly) following the specifications in RFC 7748 (and its errata list !). Need two clarifications please. The private key is randomly generated 32 ...
quasar66's user avatar
  • 175
1 vote
2 answers
167 views

What scheme is the best for combining two shared secrets?

I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
Zola Gonano's user avatar
1 vote
1 answer
200 views

Is it safe to derive Ed25519 and Kyber private keys from the same seed?

I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows: Alice sending a file/message to Bob: ...
Zola Gonano's user avatar
1 vote
1 answer
138 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
crypto_beginner's user avatar
1 vote
1 answer
139 views

How to most inexpensively extract 1 byte of uniformly distributed entropy from a 32-byte Curve25519 EC point

I'm looking for the simplest and most inexpensive hash with the following properties: Input: A 32-byte Curve25519 EC point containing approximately 125 bits of non-uniformly distributed entropy (...
knaccc's user avatar
  • 4,732
1 vote
1 answer
261 views

JOSE: JWE CEK Initialization Vector Position or Reuse

So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content. My issue however is that NaCl needs an IV (nonce in NaCl) for ...
Wil W's user avatar
  • 131
1 vote
1 answer
470 views

ECDH, x25519 and limitations for securing client-certificates on the server

g'day Crypto.SE I'm working on a practical application of sharing a static key to better-identify a user, between the recipient (server) and the initiator (client ie. user's machine). My core ...
brynk's user avatar
  • 318
1 vote
1 answer
643 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
Woodstock's user avatar
  • 1,394
1 vote
2 answers
148 views

SHA-512 for ECDH key derivation

I'm currently working in a constrained environment and need to derive a symmetric key (that will be used for AES-256 in GCM mode later) based on a low-entropy shared secret obtained via X25519. To ...
alexck's user avatar
  • 13
1 vote
1 answer
175 views

McCallum-Relyea exchange on x25519 elliptic curve

Background I have a degree in electronics engineering, I'm not bad at programming with many languages, but I'm not that good at cryptography, I'm just able to use that from libraries, and I understand ...
Luca Anastasio's user avatar
1 vote
0 answers
38 views

Is it possible to compute the X25519 scalar multiplication of the SSH key exchange using the ED25519 sliding window implementation?

There are many different ED25519/Curve25519/X25519 implementations around. I focus on two of them: https://github.com/jedisct1/libsodium https://github.com/floodyberry/ed25519-donna The libsodium ...
bebbo's user avatar
  • 156
1 vote
0 answers
42 views

Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between ...
thera's user avatar
  • 346
1 vote
0 answers
251 views

Proof of possession of a x25519 private key

In this question one way is shown how to prove the possession of a private x25519 key. Would the following protocol also be suitable to prevent someone from using the client as a decryption Oracle? ...
stsch's user avatar
  • 11
1 vote
0 answers
45 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
knaccc's user avatar
  • 4,732
1 vote
0 answers
259 views

How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random. My goal is to use the ...
Andrej Mitrović's user avatar
1 vote
0 answers
95 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
Ziva's user avatar
  • 235
0 votes
1 answer
61 views

Can X25519 (mult with basepoint) be reversed?

I admit I don't know a lot about the math behind Curve25519 and the DH exchange based on it. I'm asking if after publishing the result of this operation: ...
norbing's user avatar
0 votes
1 answer
89 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
mahnunchik's user avatar