↑ arvau

Wikipedia / Elliptic-curve Diffie–Hellman

Elliptic-curve Diffie–Hellman (ECDH) is a key agreement protocol that allows two parties, each having an elliptic-curve public–private key pair, to establish a shared secret over an insecure channel. This shared secret may be directly used as a key, or to derive another key. The key, or the derived key, can then be used to encrypt subsequent communications using a symmetric-key cipher. It is a variant of the Diffie–Hellman protocol using elliptic-curve cryptography.

Key establishment protocol

The following example illustrates how a shared key is established. Suppose Alice wants to establish a shared key with Bob, but the only channel available for them may be eavesdropped by a third party. Initially, the domain parameters, that is, the result of adding. Each party must know the other party's public key prior to execution of the protocol.

(the x using some hash-based key derivation function.

.

The only information about her key that Alice initially exposes is her public key. So, no party except Alice can determine Alice's private key (Alice of course knows it by having selected it), unless that party can solve the elliptic curve discrete logarithm problem. Bob's private key is similarly secure. No party other than Alice or Bob can compute the shared secret, unless that party can solve the elliptic curve Diffie–Hellman problem.

The public keys are either static (and trusted, say via a certificate) or ephemeral (also known as ECDHE, where final 'E' stands for "ephemeral"). Ephemeral keys are temporary and not necessarily authenticated, so if authentication is desired, authenticity assurances must be obtained by other means. Authentication is necessary to avoid man-in-the-middle attacks. If one of either Alice's or Bob's public keys is static, then man-in-the-middle attacks are thwarted. Static public keys provide neither forward secrecy nor key-compromise impersonation resilience, among other advanced security properties. Holders of static private keys should validate the other public key, and should apply a secure key derivation function to the raw Diffie–Hellman shared secret to avoid leaking information about the static private key. For schemes with other security properties, see MQV.

If Alice maliciously chooses invalid curve points for her key and Bob does not validate that Alice's points are part of the selected group, she can collect enough residues of Bob's key to derive his private key. Several TLS libraries were found to be vulnerable to this attack.

. For this reason, the secret should not be used directly as a symmetric key, but it can be used as entropy for a key derivation function.

Diffie-Hellman Key Agreement on Montgomery Curves

. For more extensive discussions of Montgomery curves and their arithmetic one may follow.

is the following: . Bernstein. Following Miller, Montgomery and Bernstein, time using the Pollards rho algorithm.

The most famous example of Montgomery curve is Curve25519 which was introduced by Bernstein.. The other Montgomery curve which is part of TLS 1.3 is Curve448 which was introduced by Hamburg.. Couple of Montgomery curves named M[4698] and M[4058] competitive to Curve25519 and Curve448 respectively have been proposed in.. At 256-bit security level, three Montgomery curves named M[996558], M[952902] and M[1504058] have been proposed in. respectively. Apart from these two, other proposals of Montgomery curves can be found at.

Software

See also

References