Curve25519

在密碼學中，Curve25519是一種橢圓曲線，被設計用於橢圓曲線迪菲-赫爾曼（ECDH）密鑰交換方法，可用作提供256位元的安全金鑰。它是不被任何已知專利覆蓋的最快ECC曲線之一。^[1]^[2]

最初的Curve25519草稿將其定義成一個迪菲-赫爾曼（DH）函數。在那之後Daniel J. Bernstein提出Curve25519應被作為底層曲線的名稱，而將X25519作為其DH函數的名稱。^[3]

數學屬性

所用的曲線是 $y 2 = x 3 + 486662 x 2 + x$ ，蒙哥馬利曲線，在由素數 $2255 - 19$ 定義的素數場的二次擴展上，並且使用基點 $x = 9$ 。這個基點的階數是 $(2^{252}+27742317777372353535851937790883648493)$ ^[4].

該協議使用壓縮橢圓點（僅X座標），因此它允許在ECDH中高效地使用Montgomery梯子，僅使用XZ座標。^[5]

Curve25519的構造使其避免了許多潛在的實現缺陷。^[6] 根據設計，它不受定時攻擊的影響，並且它接受任何32字節的字符串作為有效的公鑰，並且不需要驗證。

該曲線在雙有理幾何上等同於Ed25519簽名方案中使用的扭曲Edwards曲線。^[7]

普及

庫

Libgcrypt^[8]
libssh^[9]
NaCl^[10]
GnuTLS^[11]
mbed TLS (前稱 PolarSSL)^[12]
wolfSSL^[13]
Botan^[14]
SChannel^[a]^[15]
Libsodium^[16]
OpenSSL 自版本 1.1.0^[17]
LibreSSL^[18]
NaCl for Tcl — 一個對 Tcl 語言的端口^[19]
NSS 自版本 3.28^[20]
Monocypher^[21]
Crypto++

協議

OMEMO, 一個對XMPP (Jabber)的建議性擴展^[22]
Secure Shell
Signal Protocol
Tox
Zcash
TLS

應用

腳註

[a]
從Windows 10 (1607)及Windows Server 2016開始使用。
[b]
Via the OMEMO protocol
[c]
Only in "secret conversations"
[d]
Via the Signal Protocol
[e]
Only in "incognito mode"
[f]
Used to sign releases and packages^[32]^[33]
[g]
Exclusive key exchange in OpenSSH 6.7 when compiled without OpenSSL.^[34]^[35]

參見

EdDSA

引用

[1]
Bernstein. Irrelevant patents on elliptic-curve cryptography. cr.yp.to. [2016-02-08]. （原始內容存檔於2017-08-25）.
[2]
A state-of-the-art Diffie-Hellman function （頁面存檔備份，存於網際網路檔案館） by Daniel J. Bernstein"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain. "
[3]
[Cfrg] 25519 naming. [2016-02-25]. （原始內容存檔於2018-04-08）.
[4]
Bernstein, Daniel J. Yung, Moti; Dodis, Yevgeniy; Kiayias, Aggelos; et al , 編. Curve25519: New Diffie-Hellman Speed Records (PDF). Public Key Cryptography. Lecture Notes in Computer Science 3958. New York: Springer: 207–228. 2006 [2019-10-22]. ISBN 978-3-540-33851-2. MR 2423191. doi:10.1007/11745853_14. （原始內容存檔 (PDF)於2020-01-22）.
[5]
Lange, Tanja. EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves. EFD / Explicit-Formulas Database. [8 February 2016]. （原始內容存檔於2017-03-09）.
[6]
SafeCurves: Introduction. safecurves.cr.yp.to. [2016-02-08]. （原始內容存檔於2017-09-05）.
[7]
Bernstein, Daniel J.; Lange, Tanja. Kurosawa, Kaoru , 編. Faster addition and doubling on elliptic curves. Advances in cryptology—ASIACRYPT. Lecture Notes in Computer Science 4833. Berlin: Springer: 29–50. 2007 [2018-12-10]. ISBN 978-3-540-76899-9. MR 2565722. doi:10.1007/978-3-540-76900-2_3. （原始內容存檔於2018-12-15）.
[8]
Werner Koch. Libgcrypt 1.7.0 release announcement. 15 April 2016 [22 April 2016]. （原始內容存檔於2017-01-22）.
[9]
SSH implementation comparison. Comparison of key exchange methods. [2016-02-25]. （原始內容存檔於2017-09-24）.
[10]
Introduction. yp.to. [11 December 2014]. （原始內容存檔於2017-10-07）.
[11]
nettle: curve25519.h File Reference - doxygen documentation | Fossies Dox. fossies.org. [2015-05-19]. （原始內容存檔於2015-05-20）.
[12]
Limited, ARM. PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL). tls.mbed.org. [2015-05-19]. （原始內容存檔於2017-01-22）.
[13]
wolfSSL Embedded SSL/TLS Library - wolfSSL Products. [2018-05-01]. （原始內容存檔於2017-09-08）.
[14]
Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File. botan.randombit.net. [2018-05-01]. （原始內容存檔於2017-12-10）.
[15]
Justinha. TLS (Schannel SSP). docs.microsoft.com. [2017-09-15]. （原始內容存檔於2018-02-28）（美國英語）.
[16]
Denis, Frank. Introduction · libsodium. libsodium.org. [2020-09-25]. （原始內容存檔於2019-09-24）.
[17]
Inc., OpenSSL Foundation,. OpenSSL. www.openssl.org. [2016-06-24]. （原始內容存檔於2018-03-17）.
[18]
Add support for ECDHE with X25519. · openbsd/src@0ad90c3. GitHub. [2018-05-01]. （原始內容存檔於2018-04-22）.
[19]
Tclers Wiki - NaCl for Tcl. [2018-05-01]. （原始內容存檔於2017-12-09）.
[20]
NSS 3.28 release notes. [25 July 2017]. （原始內容存檔於2017-12-09）.
[21]
Monocypher Manual. [2017-08-03]. （原始內容存檔於2017-10-19）.
[22]
Straub, Andreas. OMEMO Encryption. conversations.im. 25 October 2015 [2018-05-01]. （原始內容存檔於2017-03-13）.
[23]
Cryptocat - Security. crypto.cat. [2016-05-24]. （原始內容存檔於2016-04-07）.
[24]
Frank Denis. DNSCrypt version 2 protocol specification. [2016-03-03]. （原始內容存檔於2015-08-13）.
[25]
Matt Johnston. Dropbear SSH - Changes. [2016-02-25]. （原始內容存檔於2018-03-23）.
[26]
Bahtiar Gadimov; et al. Gajim plugin for OMEMO Multi-End Message and Object Encryption. [2016-10-01]. （原始內容存檔於2017-12-17）.
[27]
GNUnet 0.10.0. gnunet.org. [11 December 2014]. （原始內容存檔於2017-12-09）.
[28]
zzz. 0.9.15 Release - Blog. 2014-09-20 [20 December 2014]. （原始內容存檔於2017-06-28）.
[29]
存档副本. [2018-12-05]. （原始內容存檔於2019-02-15）.
[30]
iOS Security Guide (PDF). [2018-05-01]. （原始內容存檔 (PDF)於2018-04-13）.
[31]
MRL-0003 - Monero is Not That Mysterious (PDF). getmonero.com. [2018-12-05]. （原始內容 (PDF)存檔於2019-05-01）.
[32]
Murenin, Constantine A. Soulskill , 編. OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto. Slashdot. 2014-01-19 [2014-12-27]. （原始內容存檔於2016-03-04）.
[33]
Murenin, Constantine A. timothy , 編. OpenBSD 5.5 Released. Slashdot. 2014-05-01 [2014-12-27]. （原始內容存檔於2017-05-05）.
[34]
Friedl, Markus. ssh/kex.c#kexalgs. BSD Cross Reference, OpenBSD src/usr.bin/. 2014-04-29 [2014-12-27]. （原始內容存檔於2017-12-09）.
[35]
Murenin, Constantine A. Soulskill , 編. OpenSSH No Longer Has To Depend On OpenSSL. Slashdot. 2014-04-30 [2014-12-26]. （原始內容存檔於2016-06-24）.
[36]
How does Peerio implement end-to-end encryption?. Peerio. [2018-05-01]. （原始內容存檔於2017-12-09）.
[37]
PuTTY Change Log. www.chiark.greenend.org.uk. [2018-05-01]. （原始內容存檔於2018-02-02）.
[38]
Threema Cryptography Whitepaper (PDF). [2018-05-01]. （原始內容 (PDF)存檔於2017-09-21）.
[39]
Roger Dingledine & Nick Mathewson. Tor's Protocol Specifications - Blog. [20 December 2014]. （原始內容存檔於2018-11-15）.
[40]
Viber Encryption Overview. Viber. 3 May 2016 [24 September 2016]. （原始內容存檔於2016-10-24）.

外部連結

官方網站

[15] [a]
從Windows 10 (1607)及Windows Server 2016開始使用。

[OMEMO-24] [b]
Via the OMEMO protocol

[28] [c]
Only in "secret conversations"

[SIGNAL-29] [d]
Via the Signal Protocol

[32] [e]
Only in "incognito mode"

[39] [f]
Used to sign releases and packages^[32]^[33]

[42] [g]
Exclusive key exchange in OpenSSH 6.7 when compiled without OpenSSL.^[34]^[35]

[1] [1]
Bernstein. Irrelevant patents on elliptic-curve cryptography. cr.yp.to. [2016-02-08]. （原始內容存檔於2017-08-25）.

[2] [2]
A state-of-the-art Diffie-Hellman function （頁面存檔備份，存於網際網路檔案館） by Daniel J. Bernstein"My curve25519 library computes the Curve25519 function at very high speed. The library is in the public domain. "

[3] [3]
[Cfrg] 25519 naming. [2016-02-25]. （原始內容存檔於2018-04-08）.

[:2-4] [4]
Bernstein, Daniel J. Yung, Moti; Dodis, Yevgeniy; Kiayias, Aggelos; et al , 編. Curve25519: New Diffie-Hellman Speed Records (PDF). Public Key Cryptography. Lecture Notes in Computer Science 3958. New York: Springer: 207–228. 2006 [2019-10-22]. ISBN 978-3-540-33851-2. MR 2423191. doi:10.1007/11745853_14. （原始內容存檔 (PDF)於2020-01-22）.

[5] [5]
Lange, Tanja. EFD / Genus-1 large-characteristic / XZ coordinates for Montgomery curves. EFD / Explicit-Formulas Database. [8 February 2016]. （原始內容存檔於2017-03-09）.

[6] [6]
SafeCurves: Introduction. safecurves.cr.yp.to. [2016-02-08]. （原始內容存檔於2017-09-05）.

[7] [7]
Bernstein, Daniel J.; Lange, Tanja. Kurosawa, Kaoru , 編. Faster addition and doubling on elliptic curves. Advances in cryptology—ASIACRYPT. Lecture Notes in Computer Science 4833. Berlin: Springer: 29–50. 2007 [2018-12-10]. ISBN 978-3-540-76899-9. MR 2565722. doi:10.1007/978-3-540-76900-2_3. （原始內容存檔於2018-12-15）.

[8] [8]
Werner Koch. Libgcrypt 1.7.0 release announcement. 15 April 2016 [22 April 2016]. （原始內容存檔於2017-01-22）.

[sshcompare-9] [9]
SSH implementation comparison. Comparison of key exchange methods. [2016-02-25]. （原始內容存檔於2017-09-24）.

[10] [10]
Introduction. yp.to. [11 December 2014]. （原始內容存檔於2017-10-07）.

[11] [11]
nettle: curve25519.h File Reference - doxygen documentation | Fossies Dox. fossies.org. [2015-05-19]. （原始內容存檔於2015-05-20）.

[12] [12]
Limited, ARM. PolarSSL 1.3.3 released - Tech Updates - mbed TLS (Previously PolarSSL). tls.mbed.org. [2015-05-19]. （原始內容存檔於2017-01-22）.

[13] [13]
wolfSSL Embedded SSL/TLS Library - wolfSSL Products. [2018-05-01]. （原始內容存檔於2017-09-08）.

[14] [14]
Botan: src/lib/pubkey/curve25519/curve25519.cpp Source File. botan.randombit.net. [2018-05-01]. （原始內容存檔於2017-12-10）.

[16] [15]
Justinha. TLS (Schannel SSP). docs.microsoft.com. [2017-09-15]. （原始內容存檔於2018-02-28）（美國英語）.

[17] [16]
Denis, Frank. Introduction · libsodium. libsodium.org. [2020-09-25]. （原始內容存檔於2019-09-24）.

[18] [17]
Inc., OpenSSL Foundation,. OpenSSL. www.openssl.org. [2016-06-24]. （原始內容存檔於2018-03-17）.

[19] [18]
Add support for ECDHE with X25519. · openbsd/src@0ad90c3. GitHub. [2018-05-01]. （原始內容存檔於2018-04-22）.

[20] [19]
Tclers Wiki - NaCl for Tcl. [2018-05-01]. （原始內容存檔於2017-12-09）.

[21] [20]
NSS 3.28 release notes. [25 July 2017]. （原始內容存檔於2017-12-09）.

[22] [21]
Monocypher Manual. [2017-08-03]. （原始內容存檔於2017-10-19）.

[23] [22]
Straub, Andreas. OMEMO Encryption. conversations.im. 25 October 2015 [2018-05-01]. （原始內容存檔於2017-03-13）.

[25] [23]
Cryptocat - Security. crypto.cat. [2016-05-24]. （原始內容存檔於2016-04-07）.

[26] [24]
Frank Denis. DNSCrypt version 2 protocol specification. [2016-03-03]. （原始內容存檔於2015-08-13）.

[27] [25]
Matt Johnston. Dropbear SSH - Changes. [2016-02-25]. （原始內容存檔於2018-03-23）.

[gajim-omemo-30] [26]
Bahtiar Gadimov; et al. Gajim plugin for OMEMO Multi-End Message and Object Encryption. [2016-10-01]. （原始內容存檔於2017-12-17）.

[31] [27]
GNUnet 0.10.0. gnunet.org. [11 December 2014]. （原始內容存檔於2017-12-09）.

[33] [28]
zzz. 0.9.15 Release - Blog. 2014-09-20 [20 December 2014]. （原始內容存檔於2017-06-28）.

[34] [29]
存档副本. [2018-12-05]. （原始內容存檔於2019-02-15）.

[35] [30]
iOS Security Guide (PDF). [2018-05-01]. （原始內容存檔 (PDF)於2018-04-13）.

[36] [31]
MRL-0003 - Monero is Not That Mysterious (PDF). getmonero.com. [2018-12-05]. （原始內容 (PDF)存檔於2019-05-01）.

[37] [32]
Murenin, Constantine A. Soulskill , 編. OpenBSD Moving Towards Signed Packages — Based On D. J. Bernstein Crypto. Slashdot. 2014-01-19 [2014-12-27]. （原始內容存檔於2016-03-04）.

[38] [33]
Murenin, Constantine A. timothy , 編. OpenBSD 5.5 Released. Slashdot. 2014-05-01 [2014-12-27]. （原始內容存檔於2017-05-05）.

[40] [34]
Friedl, Markus. ssh/kex.c#kexalgs. BSD Cross Reference, OpenBSD src/usr.bin/. 2014-04-29 [2014-12-27]. （原始內容存檔於2017-12-09）.

[41] [35]
Murenin, Constantine A. Soulskill , 編. OpenSSH No Longer Has To Depend On OpenSSL. Slashdot. 2014-04-30 [2014-12-26]. （原始內容存檔於2016-06-24）.

[43] [36]
How does Peerio implement end-to-end encryption?. Peerio. [2018-05-01]. （原始內容存檔於2017-12-09）.

[44] [37]
PuTTY Change Log. www.chiark.greenend.org.uk. [2018-05-01]. （原始內容存檔於2018-02-02）.

[45] [38]
Threema Cryptography Whitepaper (PDF). [2018-05-01]. （原始內容 (PDF)存檔於2017-09-21）.

[46] [39]
Roger Dingledine & Nick Mathewson. Tor's Protocol Specifications - Blog. [20 December 2014]. （原始內容存檔於2018-11-15）.

[47] [40]
Viber Encryption Overview. Viber. 3 May 2016 [24 September 2016]. （原始內容存檔於2016-10-24）.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[a]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[b]

[23]

[24]

[25]

[c]

[d]

[26]

[27]

[e]

[28]

[29]

[30]

[31]

[f]

[g]

[36]

[37]

[38]

[39]

[40]

[32]

[33]

[34]

[35]