Curve25519 is a Montgomery curve with desirable cryptographic
properties that make it comparatively easy to use safely and reliably.
Its points are hexadecimal atoms denoting the u-coordinate, and X25519
(RFC 7748) scalar multiplication is the recommended way to establish a
shared secret. See Establishing a shared secret (section
3.12) for the general procedure, which is carried out with the
following two predicates:
- [det]curve25519_generator(-Generator)
- Points on Curve25519 are hexadecimal atoms denoting the u-coordinate of
the Montgomery curve. Generator is the generator point of
Curve25519.
- [semidet]curve25519_scalar_mult(+Scalar,
+Point, -Result)
- Result is the point Scalar*Point
on Curve25519, as mandated by X25519 (RFC 7748). Scalar is an
integer between 0 and 2
^256-1, or 32 bytes. Fails if Point
has small order, i.e., if the result would be the point at infinity.
Alice and Bob can use this to establish a shared secret, where
Generator is obtained with curve25519_generator/1:
- Alice creates a random integer a and sends As =
a*Generator to Bob.
- Bob creates a random integer b and sends Bs = b*Generator
to Alice.
- Alice computes Rs = a*Bs.
- Bob computes Rs = b*As.
- Alice and Bob use crypto_data_hkdf/4
on Rs with suitable (same) parameters to obtain keys and initialization
vectors for symmetric encryption.
If a and b are kept secret, this method is considered
very secure.
