Curve25519

在密码学中，Curve25519是一种椭圆曲线，被设计用于椭圆曲线迪菲-赫尔曼（ECDH）密钥交换方法，可用作提供256比特的安全密钥。它是不被任何已知专利覆盖的最快ECC曲线之一。^[1]^[2]

最初的Curve25519草稿将其定义成一个迪菲-赫尔曼（DH）函数。在那之后Daniel J. Bernstein提出Curve25519应被作为底层曲线的名称，而将X25519作为其DH函数的名称。^[3]

数学属性

所用的曲线是 $y 2 = x 3 + 486662 x 2 + x$ ，蒙哥马利曲线，在由素数 $2255 - 19$ 定义的素数场的二次扩展上，并且使用基点 $x = 9$ 。这个基点的阶数是 $(2^{252} + 27742317777372353535851937790883648493)$ ^[4].

该协议使用压缩椭圆点（仅X座标），因此它允许在ECDH中高效地使用Montgomery梯子，仅使用XZ座标。^[5]

Curve25519的构造使其避免了许多潜在的实现缺陷。^[6]根据设计，它不受定时攻击的影响，并且它接受任何32字节的字符串作为有效的公钥，并且不需要验证。

该曲线在双有理几何上等同于Ed25519签名方案中使用的扭曲Edwards曲线。^[7]

普及

库

Libgcrypt^[8]
libssh^[9]
NaCl^[10]
GnuTLS^[11]
mbed TLS (前称 PolarSSL)^[12]
wolfSSL^[13]
Botan^[14]
SChannel^[a]^[15]
Libsodium^[16]
OpenSSL 自版本 1.1.0^[17]
LibreSSL^[18]
NaCl for Tcl — 一个对 Tcl 语言的端口^[19]
NSS 自版本 3.28^[20]
Monocypher^[21]
Crypto++

协议

OMEMO, 一个对XMPP (Jabber)的建议性扩展^[22]
Secure Shell
Signal Protocol
Tox
Zcash
TLS

应用

脚注

↑ 从Windows 10 (1607)及Windows Server 2016开始使用。
↑ ^2.0 ^2.1 ^2.2 Via the OMEMO protocol
↑ Only in "secret conversations"
↑ ^4.0 ^4.1 ^4.2 ^4.3 Via the Signal Protocol
↑ Only in "incognito mode"
↑ Used to sign releases and packages^[32]^[33]
↑ Exclusive key exchange in OpenSSH 6.7 when compiled without OpenSSL.^[34]^[35]

参见

EdDSA

引用

↑ Bernstein. Irrelevant patents on elliptic-curve cryptography. cr.yp.to. [2016-02-08].
↑ A state-of-the-art Diffie-Hellman function by Daniel J. Bernstein"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain. "
↑ [Cfrg] 25519 naming. [2016-02-25].
↑ Bernstein, Daniel J. Yung, Moti; Dodis, Yevgeniy; Kiayias, Aggelos; et al , 编. Curve25519: New Diffie-Hellman Speed Records (PDF). Public Key Cryptography. Lecture Notes in Computer Science 3958. New York: Springer: 207–228. 2006 [2019-10-22]. ISBN 978-3-540-33851-2. MR 2423191. doi:10.1007/11745853_14.
↑ Lange, Tanja. EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves. EFD / Explicit-Formulas Database. [2016-02-08].
↑ SafeCurves: Introduction. safecurves.cr.yp.to. [2016-02-08].
↑ Bernstein, Daniel J.; Lange, Tanja. Kurosawa, Kaoru , 编. Faster addition and doubling on elliptic curves. Advances in cryptology—ASIACRYPT. Lecture Notes in Computer Science 4833. Berlin: Springer: 29–50. 2007 [2018-12-10]. ISBN 978-3-540-76899-9. MR 2565722. doi:10.1007/978-3-540-76900-2_3.
↑ Werner Koch. Libgcrypt 1.7.0 release announcement. 2016-04-15 [2016-04-22].
↑ ^9.0 ^9.1 ^9.2 ^9.3 ^9.4 ^9.5 ^9.6 SSH implementation comparison. Comparison of key exchange methods. [2016-02-25].
↑ Introduction. yp.to. [2014-12-11].
↑ nettle: curve25519.h File Reference - doxygen documentation | Fossies Dox. fossies.org. [2015-05-19].
↑ Limited, ARM. PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL). tls.mbed.org. [2015-05-19].
↑ wolfSSL Embedded SSL/TLS Library - wolfSSL Products. [2018-05-01].
↑ Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File. botan.randombit.net. [2018-05-01].
↑ Justinha. TLS (Schannel SSP). docs.microsoft.com. [2017-09-15] （美国英语）.
↑ Denis, Frank. Introduction · libsodium. libsodium.org. [2020-09-25].
↑ Inc., OpenSSL Foundation,. OpenSSL. www.openssl.org. [2016-06-24].
↑ Add support for ECDHE with X25519. · openbsd/src@0ad90c3. GitHub. [2018-05-01].
↑ Tclers Wiki - NaCl for Tcl. [2018-05-01].
↑ NSS 3.28 release notes. [2017-07-25].
↑ Monocypher Manual. [2017-08-03].
↑ Straub, Andreas. OMEMO Encryption. conversations.im. 2015-10-25 [2018-05-01].
↑ Cryptocat - Security. crypto.cat. [2016-05-24].
↑ Frank Denis. DNSCrypt version 2 protocol specification. [2016-03-03].
↑ Matt Johnston. Dropbear SSH - Changes. [2016-02-25].
↑ Bahtiar Gadimov; et al. Gajim plugin for OMEMO Multi-End Message and Object Encryption. [2016-10-01].
↑ GNUnet 0.10.0. gnunet.org. [2014-12-11].
↑ zzz. 0.9.15 Release - Blog. 2014-09-20 [2014-12-20].
↑ 存档副本. [2018-12-05].
↑ iOS Security Guide (PDF). [2018-05-01].
↑ MRL-0003 - Monero is Not That Mysterious (PDF). getmonero.com. [2018-12-05].
↑ Murenin, Constantine A. Soulskill , 编. OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto. Slashdot. 2014-01-19 [2014-12-27].
↑ Murenin, Constantine A. timothy , 编. OpenBSD 5.5 Released. Slashdot. 2014-05-01 [2014-12-27].
↑ Friedl, Markus. ssh/kex.c#kexalgs. BSD Cross Reference, OpenBSD src/usr.bin/. 2014-04-29 [2014-12-27].
↑ Murenin, Constantine A. Soulskill , 编. OpenSSH No Longer Has To Depend On OpenSSL. Slashdot. 2014-04-30 [2014-12-26].
↑ How does Peerio implement end-to-end encryption?. Peerio. [2018-05-01].
↑ PuTTY Change Log. www.chiark.greenend.org.uk. [2018-05-01].
↑ Threema Cryptography Whitepaper (PDF). [2018-05-01].
↑ Roger Dingledine & Nick Mathewson. Tor's Protocol Specifications - Blog. [2014-12-20].
↑ Viber Encryption Overview. Viber. 2016-05-03 [2016-09-24].

外部链接

官方网站

[15] 从Windows 10 (1607)及Windows Server 2016开始使用。

[OMEMO-24] 2.0 ^2.1 ^2.2 Via the OMEMO protocol

[28] Only in "secret conversations"

[SIGNAL-29] 4.0 ^4.1 ^4.2 ^4.3 Via the Signal Protocol

[32] Only in "incognito mode"

[39] Used to sign releases and packages^[32]^[33]

[42] Exclusive key exchange in OpenSSH 6.7 when compiled without OpenSSL.^[34]^[35]

[1] Bernstein. Irrelevant patents on elliptic-curve cryptography. cr.yp.to. [2016-02-08].

[2] A state-of-the-art Diffie-Hellman function by Daniel J. Bernstein"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain. "

[3] [Cfrg] 25519 naming. [2016-02-25].

[:2-4] Bernstein, Daniel J. Yung, Moti; Dodis, Yevgeniy; Kiayias, Aggelos; et al , 编. Curve25519: New Diffie-Hellman Speed Records (PDF). Public Key Cryptography. Lecture Notes in Computer Science 3958. New York: Springer: 207–228. 2006 [2019-10-22]. ISBN 978-3-540-33851-2. MR 2423191. doi:10.1007/11745853_14.

[5] Lange, Tanja. EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves. EFD / Explicit-Formulas Database. [2016-02-08].

[6] SafeCurves: Introduction. safecurves.cr.yp.to. [2016-02-08].

[7] Bernstein, Daniel J.; Lange, Tanja. Kurosawa, Kaoru , 编. Faster addition and doubling on elliptic curves. Advances in cryptology—ASIACRYPT. Lecture Notes in Computer Science 4833. Berlin: Springer: 29–50. 2007 [2018-12-10]. ISBN 978-3-540-76899-9. MR 2565722. doi:10.1007/978-3-540-76900-2_3.

[8] Werner Koch. Libgcrypt 1.7.0 release announcement. 2016-04-15 [2016-04-22].

[sshcompare-9] 9.0 ^9.1 ^9.2 ^9.3 ^9.4 ^9.5 ^9.6 SSH implementation comparison. Comparison of key exchange methods. [2016-02-25].

[10] Introduction. yp.to. [2014-12-11].

[11] ttle: curve25519.h File Reference - doxygen documentation | Fossies Dox. fossies.org. [2015-05-19].

[12] Limited, ARM. PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL). tls.mbed.org. [2015-05-19].

[13] wolfSSL Embedded SSL/TLS Library - wolfSSL Products. [2018-05-01].

[14] Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File. botan.randombit.net. [2018-05-01].

[16] Justinha. TLS (Schannel SSP). docs.microsoft.com. [2017-09-15] （美国英语）.

[17] Denis, Frank. Introduction · libsodium. libsodium.org. [2020-09-25].

[18] Inc., OpenSSL Foundation,. OpenSSL. www.openssl.org. [2016-06-24].

[19] Add support for ECDHE with X25519. · openbsd/src@0ad90c3. GitHub. [2018-05-01].

[20] Tclers Wiki - NaCl for Tcl. [2018-05-01].

[21] NSS 3.28 release notes. [2017-07-25].

[22] Monocypher Manual. [2017-08-03].

[23] Straub, Andreas. OMEMO Encryption. conversations.im. 2015-10-25 [2018-05-01].

[25] Cryptocat - Security. crypto.cat. [2016-05-24].

[26] Frank Denis. DNSCrypt version 2 protocol specification. [2016-03-03].

[27] Matt Johnston. Dropbear SSH - Changes. [2016-02-25].

[gajim-omemo-30] Bahtiar Gadimov; et al. Gajim plugin for OMEMO Multi-End Message and Object Encryption. [2016-10-01].

[31] GNUnet 0.10.0. gnunet.org. [2014-12-11].

[33] zzz. 0.9.15 Release - Blog. 2014-09-20 [2014-12-20].

[34] 存档副本. [2018-12-05].

[35] OS Security Guide (PDF). [2018-05-01].

[36] MRL-0003 - Monero is Not That Mysterious (PDF). getmonero.com. [2018-12-05].

[37] Murenin, Constantine A. Soulskill , 编. OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto. Slashdot. 2014-01-19 [2014-12-27].

[38] Murenin, Constantine A. timothy , 编. OpenBSD 5.5 Released. Slashdot. 2014-05-01 [2014-12-27].

[40] Friedl, Markus. ssh/kex.c#kexalgs. BSD Cross Reference, OpenBSD src/usr.bin/. 2014-04-29 [2014-12-27].

[41] Murenin, Constantine A. Soulskill , 编. OpenSSH No Longer Has To Depend On OpenSSL. Slashdot. 2014-04-30 [2014-12-26].

[43] How does Peerio implement end-to-end encryption?. Peerio. [2018-05-01].

[44] PuTTY Change Log. www.chiark.greenend.org.uk. [2018-05-01].

[45] Threema Cryptography Whitepaper (PDF). [2018-05-01].

[46] Roger Dingledine & Nick Mathewson. Tor's Protocol Specifications - Blog. [2014-12-20].

[47] Viber Encryption Overview. Viber. 2016-05-03 [2016-09-24].

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[a]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[b]

[23]

[24]

[25]

[c]

[d]

[26]

[27]

[e]

[28]

[29]

[30]

[31]

[f]

[g]

[36]

[37]

[38]

[39]

[40]

[32]

[33]

[34]

[35]