Curve25519
In cryptography, Curve25519 is an elliptic curve used in elliptic-curve cryptography (ECC) offering 128 bits of security (256-bit key size) and designed for use with the Elliptic-curve Diffie–Hellman (ECDH) key agreement scheme. It is one of the fastest curves in ECC, and is not covered by any known patents.[1] The reference implementation is public domain software.[2][3]
The original Curve25519 paper defined it as a Diffie–Hellman (DH) function. Daniel J. Bernstein has since proposed that the name "Curve25519" be used for the underlying curve, and the name "X25519" for the DH function.[4]
Mathematical properties
The curve used is [math]\displaystyle{ y^2 = x^3 + 486662x^2 + x }[/math], a Montgomery curve, over the prime field defined by the prime number [math]\displaystyle{ 2^{255} - 19 }[/math] (hence the numeric "25519" in the name), and it uses the base point [math]\displaystyle{ x = 9 }[/math]. This point generates a cyclic subgroup whose order is the prime [math]\displaystyle{ 2^{252} + 27742317777372353535851937790883648493 }[/math]. This subgroup has a co-factor of [math]\displaystyle{ 8 }[/math], meaning the number of elements in the subgroup is [math]\displaystyle{ 1/8 }[/math] that of the elliptic curve group. Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack.[5]
The protocol uses compressed elliptic point (only X coordinates), so it allows efficient use of the Montgomery ladder for ECDH, using only XZ coordinates.[6]
Curve25519 is constructed such that it avoids many potential implementation pitfalls.[7]
By design, Curve25519 is immune to timing attacks, and it accepts any 32-byte string as a valid public key and does not require validating that a given point belongs to the curve, or is generated by the base point.[citation needed]
The curve is birationally equivalent to a twisted Edwards curve used in the Ed25519[8][9] signature scheme.[10]
History
In 2005, Curve25519 was first released by Daniel J. Bernstein.[5]
In 2013, interest began to increase considerably when it was discovered that the NSA had potentially implemented a backdoor into the P-256 curve based Dual EC DRBG algorithm.[11] While not directly related,[12] suspicious aspects of the NIST's P curve constants[13] led to concerns[14] that the NSA had chosen values that gave them an advantage in breaking the encryption.[15][16]
"I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry."
Since 2013, Curve25519 has become the de facto alternative to P-256, being used in a wide variety of applications.[17] Starting in 2014, OpenSSH[18] defaults to Curve25519-based ECDH and GnuPG adds support for Ed25519 keys for signing and encryption.[19] Behavior for general SSH protocol is still being standardized as of 2018.[20][needs update]
In 2017, NIST announced that Curve25519 and Curve448 would be added to Special Publication 800-186, which specifies approved elliptic curves for use by the US Federal Government.[21] Both are described in RFC 7748.[22] A 2019 draft of "FIPS 186-5" notes the intention to allow usage of Ed25519[23] for digital signatures. A 2019 draft of Special Publication 800-186 notes the intention to allow usage of Curve25519.[24]
In 2018, DKIM specification was amended so as to allow signatures with this algorithm.[25]
Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It recommends support for X25519, Ed25519, X448, and Ed448 algorithms.[26]
Libraries
- Libgcrypt[27]
- libssh[18][28]
- libssh2 (since version 1.9.0)
- NaCl[29]
- GnuTLS[30]
- mbed TLS (formerly PolarSSL)[31]
- wolfSSL[32]
- Botan[33]
- Schannel[lower-alpha 1][34]
- Libsodium[35]
- OpenSSL since version 1.1.0[36]
- LibreSSL[37]
- NSS since version 3.28[38]
- Crypto++
- curve25519-dalek[39]
- Bouncy Castle[40]
Protocols
- OMEMO, a proposed extension for XMPP (Jabber)[41]
- Secure Shell
- Signal Protocol
- Matrix (protocol)
- Tox
- Zcash
- Transport Layer Security
- WireGuard
Applications
- Conversations Android application[lower-alpha 2]
- Cryptocat[42][lower-alpha 2]
- DNSCrypt[43]
- DNSCurve
- Dropbear[28][44]
- Facebook Messenger [lower-alpha 3][lower-alpha 4]
- Gajim via plugin[45][lower-alpha 2]
- GNUnet[46]
- GnuPG
- Google Allo[lower-alpha 5][lower-alpha 4]
- I2P[47]
- IPFS[48]
- iOS[49]
- Monero[50]
- OpenBSD[lower-alpha 6]
- OpenSSH[28][lower-alpha 7]
- Peerio[55]
- Proton Mail[56]
- PuTTY[57]
- Signal[lower-alpha 4]
- Silent Phone
- SmartFTP[28]
- SSHJ[28]
- SQRL[58]
- Threema Instant Messenger[59]
- TinySSH[28]
- TinyTERM[28]
- Tor[60]
- Viber[61]
- WhatsApp[lower-alpha 4][62]
- Wire
- WireGuard
Notes
- ↑ Starting with Windows 10 (1607), Windows Server 2016
- ↑ 2.0 2.1 2.2 Via the OMEMO protocol
- ↑ Only in "secret conversations"
- ↑ 4.0 4.1 4.2 4.3 Via the Signal Protocol
- ↑ Only in "incognito mode"
- ↑ Used to sign releases and packages[51][52]
- ↑ Exclusive key exchange in OpenSSH 6.7 when compiled without OpenSSL.[53][54]
References
- ↑ Bernstein. "Irrelevant patents on elliptic-curve cryptography". https://cr.yp.to/ecdh/patents.html.
- ↑ A state-of-the-art Diffie-Hellman function by Daniel J. Bernstein"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain."
- ↑ "X25519". 5 March 2019. https://www.cryptopp.com/wiki/X25519.
- ↑ "[Cfrg 25519 naming"]. https://www.ietf.org/mail-archive/web/cfrg/current/msg04996.html.
- ↑ 5.0 5.1 Bernstein, Daniel J. (2006). "Public Key Cryptography - PKC 2006". in Yung, Moti; Dodis, Yevgeniy; Kiayias, Aggelos et al.. Public Key Cryptography. 3958. New York: Springer. pp. 207–228. doi:10.1007/11745853_14. ISBN 978-3-540-33851-2.
- ↑ Lange, Tanja. "EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves". https://www.hyperelliptic.org/EFD/g1p/auto-montgom-xz.html.
- ↑ Bernstein, Daniel J.; Lange, Tanja (2017-01-22). "SafeCurves: Introduction". SafeCurves: choosing safe curves for elliptic-curve cryptography. https://safecurves.cr.yp.to.
- ↑ Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Yang, Bo-Yin (2017-01-22). "Ed25519: high-speed high-security signatures". http://ed25519.cr.yp.to/.
- ↑ Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Yang, Bo-Yin (2011-09-26). "High-speed high-security signatures". http://ed25519.cr.yp.to/ed25519-20110926.pdf.
- ↑ Bernstein, Daniel J.; Lange, Tanja (2007). "Advances in Cryptology – ASIACRYPT 2007". in Kurosawa, Kaoru. Advances in cryptology—ASIACRYPT. 4833. Berlin: Springer. pp. 29–50. doi:10.1007/978-3-540-76900-2_3. ISBN 978-3-540-76899-9.
- ↑ Kelsey, John (May 2014). "Dual EC in X9.82 and SP 800-90". https://csrc.nist.gov/csrc/media/projects/crypto-standards-development-process/documents/dualec_in_x982_and_sp800-90.pdf.
- ↑ Green, Matthew (2015-01-14). "A Few Thoughts on Cryptographic Engineering: The Many Flaws of Dual_EC_DRBG". http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html.
- ↑ "SafeCurves: Introduction". https://safecurves.cr.yp.to/.
- ↑ Maxwell, Gregory (2013-09-08). "[tor-talk NIST approved crypto in Tor?"]. https://lists.torproject.org/pipermail/tor-talk/2013-September/029956.html.
- ↑ "SafeCurves: Rigidity". https://safecurves.cr.yp.to/rigid.html.
- ↑ "The NSA Is Breaking Most Encryption on the Internet - Schneier on Security". https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675929.
- ↑ "Things that use Curve25519". https://ianix.com/pub/curve25519-deployment.html.
- ↑ 18.0 18.1 Adamantiadis, Aris (2013-11-03). "OpenSSH introduces curve25519-sha256@libssh.org key exchange !". libssh.org. https://www.libssh.org/2013/11/03/openssh-introduces-curve25519-sha256libssh-org-key-exchange/.
- ↑ "GnuPG - What's new in 2.1". August 2021. https://gnupg.org/faq/whats-new-in-2.1.html.
- ↑ A. Adamantiadis; libssh; S. Josefsson; SJD AB; M. Baushke; Juniper Networks, Inc. (2018-06-26), Secure Shell (SSH) Key Exchange Method using Curve25519 and Curve448, I-D draft-ietf-curdle-ssh-curves-08, https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-08
- ↑ "Transition Plans for Key Establishment Schemes" (in EN-US). 2017-10-31. https://csrc.nist.gov/News/2017/Transition-Plans-for-Key-Establishment-Schemes.
- ↑ RFC 7748. Retrieved from rfc:7748.
- ↑ Regenscheid, Andrew (31 October 2019). FIPS PUB 186-5. doi:10.6028/NIST.FIPS.186-5-draft. https://csrc.nist.gov/publications/detail/fips/186/5/draft.
- ↑ "Recommendations for Discrete Logarithm-Based Cryptography". https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-186-draft.pdf.
- ↑ John Levine (September 2018), A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM), IETF, doi:10.17487/RFC8463, RFC 8463, https://tools.ietf.org/html/rfc8463
- ↑ E Rescorla (September 2018), The Transport Layer Security (TLS) Protocol Version 1.3, IETF, doi:10.17487/RFC8446, RFC 8446, https://tools.ietf.org/html/rfc8446
- ↑ Werner Koch (15 April 2016). "Libgcrypt 1.7.0 release announcement". https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000386.html.
- ↑ 28.0 28.1 28.2 28.3 28.4 28.5 28.6 SSH implementation comparison. "Comparison of key exchange methods". http://ssh-comparison.quendi.de/comparison/kex.html.
- ↑ "Introduction". yp.to. https://nacl.cr.yp.to/.
- ↑ "nettle: curve25519.h File Reference". http://fossies.org/dox/nettle-3.1.1/curve25519_8h.html.
- ↑ Limited, ARM. "PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL)". https://tls.mbed.org/tech-updates/releases/polarssl-1.3.3-released.
- ↑ "wolfSSL Embedded SSL/TLS Library | Products – wolfSSL". https://www.wolfssl.com/products/wolfssl/.
- ↑ "Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File". http://botan.randombit.net/doxygen/curve25519_8cpp_source.html.
- ↑ Justinha. "TLS (Schannel SSP)" (in en-us). https://docs.microsoft.com/en-us/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server.
- ↑ Denis, Frank. "Introduction · libsodium". https://libsodium.org.
- ↑ "OpenSSL 1.1.0 Series Release Notes". https://www.openssl.org/news/openssl-1.1.0-notes.html.
- ↑ "Add support for ECDHE with X25519. · openbsd/src@0ad90c3". https://github.com/openbsd/src/commit/0ad90c3e6b15b9b6b8463a8a0f87d70c83a07ef4.
- ↑ "NSS 3.28 release notes". https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28_release_notes.
- ↑ "A pure-Rust implementation of group operations on ristretto255 and Curve25519". https://github.com/dalek-cryptography/curve25519-dalek/.
- ↑ "Ed25519.java". 13 October 2021. https://github.com/bcgit/bc-java/blob/bc3b92f1f0e78b82e2584c5fb4b226a13e7f8b3b/core/src/main/java/org/bouncycastle/math/ec/rfc8032/Ed25519.java.
- ↑ Straub, Andreas (25 October 2015). "OMEMO Encryption". https://conversations.im/xeps/multi-end.html#usecases-setup.
- ↑ "Cryptocat - Security". https://crypto.cat/security.html#encryption.
- ↑ Frank Denis. "DNSCrypt version 2 protocol specification". https://github.com/jedisct1/dnscrypt-proxy/blob/master/DNSCRYPT-V2-PROTOCOL.txt/.
- ↑ Matt Johnston. "Dropbear SSH - Changes". https://matt.ucc.asn.au/dropbear/CHANGES.
- ↑ Bahtiar Gadimov. "Gajim plugin for OMEMO Multi-End Message and Object Encryption". https://github.com/omemo/gajim-omemo.
- ↑ "GNUnet 0.10.0". gnunet.org. https://gnunet.org/gnunet0-10-0.
- ↑ zzz (2014-09-20). "0.9.15 Release - Blog". https://geti2p.net/en/blog/post/2014/09/20/0.9.15-Release.
- ↑ "go-ipfs_keystore.go at master". Github.com. 30 March 2022. https://github.com/ipfs/go-ipfs/blob/master/core/commands/keystore.go#L68.
- ↑ "Apple Platform Security". https://support.apple.com/guide/security/welcome/web.
- ↑ "MRL-0003 - Monero is Not That Mysterious". https://lab.getmonero.org/pubs/MRL-0003.pdf.
- ↑ Murenin, Constantine A. (2014-01-19). "OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto". in Soulskill. Slashdot. http://bsd.slashdot.org/story/14/01/19/0124202/openbsd-moving-towards-signed-packages-based-on-d-j-bernstein-crypto.
- ↑ Murenin, Constantine A. (2014-05-01). "OpenBSD 5.5 Released". in timothy. Slashdot. http://bsd.slashdot.org/story/14/05/01/1656209/openbsd-55-released.
- ↑ Friedl, Markus (2014-04-29). "ssh/kex.c#kexalgs". http://bxr.su/OpenBSD/usr.bin/ssh/kex.c#kexalgs.
- ↑ Murenin, Constantine A. (2014-04-30). "OpenSSH No Longer Has To Depend On OpenSSL". in Soulskill. Slashdot. http://it.slashdot.org/story/14/04/30/1822209/openssh-no-longer-has-to-depend-on-openssl.
- ↑ "How does Peerio implement end-to-end encryption?". https://peerio.zendesk.com/hc/en-us/articles/204155895-How-does-Peerio-implement-end-to-end-encryption.
- ↑ "Proton Mail now offers elliptic curve cryptography for advanced security and faster speeds". 25 April 2019. https://proton.me/blog/elliptic-curve-cryptography.
- ↑ "PuTTY Change Log". http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html.
- ↑ Steve Gibson (December 2019). "SQRL Cryptography whitepaper". https://www.grc.com/sqrl/SQRL_Cryptography.pdf.
- ↑ "Threema Cryptography Whitepaper". https://threema.ch/press-files/cryptography_whitepaper.pdf.
- ↑ Roger Dingledine & Nick Mathewson. "Tor's Protocol Specifications - Blog". https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt?id=b5b771b19df9fc052b424228045409467a7b6414#n81.
- ↑ "Viber Encryption Overview". Viber. 3 May 2016. https://www.viber.com/en/security-overview.
- ↑ Nidhi Rastogi; James Hendler (2017-01-24). "WhatsApp security and role of metadata in preserving privacy". arXiv:1701.06817 [cs.CR].
External links
![]() | Original source: https://en.wikipedia.org/wiki/Curve25519.
Read more |