X25519

As explained in Real-World Cryptography

X25519 is an elliptic-curve Diffie–Hellman function for deriving a shared secret from public and private keys.

Two parties can use X25519 to derive a shared secret from their public and private keys without directly sending that secret. It combines elliptic-curve Diffie–Hellman with Curve25519. section 5.3.3

Keep the mechanism and its defensive checks distinct:

• Curve25519 supplies the elliptic curve, base point, and approximately 128-bit security level. section 5.3.3
• X25519 performs the key exchange using Curve25519 and produces the shared result used by the surrounding protocol. section 5.3.3
• Implementations should check for an all-zero shared secret, because a small-subgroup public key can force that outcome. section 5.4

A dangerous public key

An attacker sends a point from Curve25519’s small subgroup as a public key. Without appropriate handling, X25519 can produce an all-zero shared secret; conservative implementations check for that result. section 5.4

Figure 5.15 A small subgroup attack impacts DH groups that have many subgroups. By choosing generators of small subgroups as public keys, an attacker can leak bits of someone’s private key little by little.

A diagram illustrates how choosing generators from small subgroups can leak bits of a private key through repeated exchanges. section 5.4

How Real-World Cryptography covers it

How deep it goes

Defines Curve25519 parameters, then examines small-subgroup, invalid-curve, contributory-behavior, and timing-attack concerns.

Examples

Uses small-subgroup public keys and all-zero shared secrets to illustrate misuse and defensive checking.

What it assumes

Assumes familiarity with public and private keys and introduces X25519 through elliptic-curve Diffie–Hellman.

What you can do after

Evaluate ECDH implementations and prefer X25519 with an all-zero-result check for conservative deployments.

How it connects

Connects X25519 with ECDH, Curve25519, small subgroup attacks, invalid curve attacks, and timing attacks.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• hybrid key exchange schemeused by · A hybrid key exchange scheme combines a conventional key exchange with a post-quantum key exchange and combines their outputs into shared keying material.
• invalid curve attackcontrasts with · An invalid curve attack supplies a point from a different elliptic curve so that an implementation performs scalar multiplication in an unintended group with exploitable subgroups.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.