Curve25519 is an elliptic curve used for Elliptic Curve Diffie-Hellman (ECDH) key exchange. It offers approximately 128 bits of classical security with much smaller keys than traditional Diffie-Hellman, making it a practical choice for modern applications. section 5.3.3 section 5.5
Use Curve25519 with careful attention to implementation behavior:
- Prefer X25519 for ECDH because its design and available implementations account for invalid-curve attacks and resist timing attacks by design. section 5.4
- Remember that Curve25519 is not a prime-order group: it contains a small subgroup of size 8 alongside the large subgroup used for ECDH. section 5.4
- Check that an X25519 shared secret is not all zero when the protocol or implementation requires protection against malicious public keys. section 5.4
- Verify received public keys where applicable; invalid keys have caused many ECDH implementation bugs. section 5.4 section 5.5
Small-subgroup attack
An attacker can send a public key from Curve25519’s small subgroup. Because X25519 lacks contributory behavior, this can force the shared secret to all zeros; related subgroup attacks can leak private-key bits incrementally. section 5.4
Figure 5.15 A small subgroup attack impacts DH groups that have many subgroups. By choosing generators of small subgroups as public keys, an attacker can leak bits of someone’s private key little by little.
Shows how generators of small subgroups can expose private-key bits little by little. section 5.4
