Elliptic-curve Diffie–Hellman explained

Elliptic-curve Diffie–Hellman (ECDH) is a key agreement protocol that allows two parties, each having an elliptic-curve public–private key pair, to establish a shared secret over an insecure channel.^{[1] [2] [3]} This shared secret may be directly used as a key, or to derive another key. The key, or the derived key, can then be used to encrypt subsequent communications using a symmetric-key cipher. It is a variant of the Diffie–Hellman protocol using elliptic-curve cryptography.

Key establishment protocol

The following example illustrates how a shared key is established. Suppose Alice wants to establish a shared key with Bob, but the only channel available for them may be eavesdropped by a third party. Initially, the domain parameters (that is,

(p, a, b, G, n, h) in the prime case or (m, f(x), a, b, G, n, h) in the binary case) must be agreed upon. Also, each party must have a key pair suitable for elliptic curve cryptography, consisting of a private key d (a randomly selected integer in the interval [ 1 , n -1 ] ) and a public key represented by a point Q (where Q = d ⋅ G , that is, the result of adding G to itself d times). Let Alice's key pair be (d _{A,} Q _{A)} and Bob's key pair be (d _{B,} Q _{B)} . Each party must know the other party's public key prior to execution of the protocol.

Alice computes point

(x _{k,} y _{k)} = d _{A} ⋅ Q _{B} . Bob computes point (x _{k,} y _{k)} = d _{B} ⋅ Q _{A} . The shared secret is x _{k} (the x coordinate of the point). Most standardized protocols based on ECDH derive a symmetric key from x _{k} using some hash-based key derivation function.

The shared secret calculated by both parties is equal, because

d _{A} ⋅ Q _{B} = d _{A} ⋅ d _{B} ⋅ G = d _{B} ⋅ d _{A} ⋅ G = d _{B} ⋅ Q _{A} .

The only information about her key that Alice initially exposes is her public key. So, no party except Alice can determine Alice's private key (Alice of course knows it by having selected it), unless that party can solve the elliptic curve discrete logarithm problem. Bob's private key is similarly secure. No party other than Alice or Bob can compute the shared secret, unless that party can solve the elliptic curve Diffie–Hellman problem.

The public keys are either static (and trusted, say via a certificate) or ephemeral (also known as ECDHE, where final 'E' stands for "ephemeral"). Ephemeral keys are temporary and not necessarily authenticated, so if authentication is desired, authenticity assurances must be obtained by other means. Authentication is necessary to avoid man-in-the-middle attacks. If one of either Alice's or Bob's public keys is static, then man-in-the-middle attacks are thwarted. Static public keys provide neither forward secrecy nor key-compromise impersonation resilience, among other advanced security properties. Holders of static private keys should validate the other public key, and should apply a secure key derivation function to the raw Diffie–Hellman shared secret to avoid leaking information about the static private key. For schemes with other security properties, see MQV.

If Alice maliciously chooses invalid curve points for her key and Bob does not validate that Alice's points are part of the selected group, she can collect enough residues of Bob's key to derive his private key. Several TLS libraries were found to be vulnerable to this attack.^[4]

The shared secret is uniformly distributed on a subset of

[ 0 , p) of size (n +1 )/ 2 . For this reason, the secret should not be used directly as a symmetric key, but it can be used as entropy for a key derivation function.

Diffie-Hellman Key Agreement on Montgomery Curves

Let

A, B \in F _{p} such that B(A ^{2} - 4 ) ≠ 0 . The Montgomery form elliptic curve E _{M,A,B} is the set of all (x,y) \in F _{p} x F _{p} satisfying the equation By ^{2} = x(x ^{2} + Ax + 1 ) along with the point at infinity denoted as inf ty . This is called the affine form of the curve. The set of all F _{p} -rational points of E _{M,A,B} , denoted as E _{M,A,B} (F _{p)} is the set of all (x,y) \in F _{p} x F _{p} satisfying By ^{2} = x(x ^{2} + Ax + 1 ) along with inf ty . Under a suitably defined addition operation, E _{M,A,B} (F _{p)} is a group with inf ty as the identity element. It is known that the order of this group is a multiple of 4. In fact, it is usually possible to obtain A and B such that the order of E _{M,A,B} is 4 q for a prime q . For more extensive discussions of Montgomery curves and their arithmetic one may follow.^{[5] [6] [7]}

For computational efficiency, it is preferable to work with projective coordinates. The projective form of the Montgomery curve

E _{M,A,B} is BY ^{2Z} = X(X ^{2} + AXZ + Z ^{2)} . For a point P = [ X : Y : Z ] on E _{M,A,B} , the x -coordinate map x is the following:^[7] x(P) = [ X : Z ] if Z ≠ 0 and x(P) = [ 1 : 0 ] if P = [ 0 : 1 : 0 ] . Bernstein^[8] introduced the map x _{0} as follows: x _{0(X} : Z) = XZ ^{p} which is defined for all values of X and Z in F _{p} . Following Miller,^[9] Montgomery and Bernstein,^[10] the Diffie-Hellman key agreement can be carried out on a Montgomery curve as follows. Let Q be a generator of a prime order subgroup of E _{M,A,B} (F _{p)} . Alice chooses a secret key s and has public key x _{0(sQ)} ; Bob chooses a secret key t and has public key x _{0(tQ)} . The shared secret key of Alice and Bob is x _{0(stQ)} . Using classical computers, the best known method of obtaining x _{0(stQ)} from Q,x _{0(sQ)} and x _{0(tQ)} requires about O(p ^{1/2} ) time using the Pollards rho algorithm.^[11]

The most famous example of Montgomery curve is Curve25519 which was introduced by Bernstein.^[10] For Curve25519,

p = 2 ^{255} - 19 , A = 486662 and B = 1 .The other Montgomery curve which is part of TLS 1.3 is Curve448 which was introducedby Hamburg.^[12] For Curve448, p = 2 ^{448} - 2 ^{224} - 1 , A = 156326 and B = 1 . Couple of Montgomery curves named M[4698] and M[4058] competitive to Curve25519 and Curve448 respectively have been proposed in.^[13] For M[4698], p = 2 ^{251} - 9 , A = 4698 , B = 1 and for M[4058], p = 2 ^{444} - 17 , A = 4058 , B = 1 . At 256-bit security level, three Montgomery curves named M[996558], M[952902] and M[1504058] have been proposed in.^[14] For M[996558], p = 2 ^{506} - 45 , A = 996558 , B = 1 , for M[952902], p = 2 ^{510} - 75 , A = 952902 , B = 1 and for M[1504058], p = 2 ^{521} - 1 , A = 1504058 , B = 1 respectively. Apart from these two, other proposals of Montgomery curves can be found at.^[15]

Software

• Curve25519 is a popular set of elliptic curve parameters and reference implementation by Daniel J. Bernstein in C. Bindings and alternative implementations are also available.
• LINE messenger app has used the ECDH protocol for its "Letter Sealing" end-to-end encryption of all messages sent through said app since October 2015.^[16]
• Signal Protocol uses ECDH to obtain post-compromise security. Implementations of this protocol are found in Signal, WhatsApp, Facebook Messenger and Skype.

See also

• Diffie–Hellman key exchange
• Forward secrecy

References

1. NIST, Special Publication 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, March, 2006.
2. Certicom Research, Standards for efficient cryptography, SEC 1: Elliptic Curve Cryptography, Version 2.0, May 21, 2009.
3. NSA Suite B Cryptography, Suite B Implementers' Guide to NIST SP 800-56A, July 28, 2009.
4. Practical Invalid Curve Attacks on TLS-ECDH. Tibor Jager. Jorg Schwenk. Juraj Somorovsky. 2015-09-04. European Symposium on Research in Computer Security (ESORICS'15).
5. Web site: Montgomery . Peter L. . Speeding the Pollard and elliptic curve methods of factorization . Mathematics of Computation, 48(177):243–264, 1987.
6. Web site: Bernstein . Daniel J. . Lange . Tanja . Montgomery curves and the Montgomery ladder . In Joppe W. Bos and Arjen K. Lenstra, editors, Topics in Computational Number Theory inspired by Peter L. Montgomery, pages 82–115. Cambridge University Press, 2017..
7. Web site: Costello . Craig . Smith . Benjamin . Montgomery curves and their arithmetic - the case of large characteristic fields . J. Cryptographic Engineering, 8(3):227–240, 2018..
8. Web site: Bernstein . Daniel J. . Can we avoid tests for zero in fast elliptic-curve arithmetic? .
9. Web site: Miller . Victor S. . Use of elliptic curves in cryptography . In Advances in Cryptology - CRYPTO’85, Santa Barbara, California, USA, August 18-22, 1985, Proceedings, pages 417–426. Springer Berlin Heidelberg, 1985.
10. Web site: Bernstein . Daniel J. . Curve25519: New Diffie-Hellman Speed Records . In: Yung, M., Dodis, Y., Kiayias, A., Malkin, T. (eds) Public Key Cryptography - PKC 2006. Lecture Notes in Computer Science, vol 3958. Springer, Berlin, Heidelberg.
11. Web site: Pollard . John M. . Monte Carlo methods for index computation mod p . Mathematics of Computation, 32:918–924, 1978.
12. Web site: Hamburg . Mike . Ed448-goldilocks, a new elliptic curve . ACR Cryptology ePrint Archive, 2015:625, 2015.
13. Web site: Nath . Kaushik . Sarkar . Palash . Security and Efficiency Trade-offs for Elliptic Curve Diffie-Hellman at the 128- and 224-bit Security Levels . J Cryptogr Eng 12, 107–121 (2022)., Code available at https://github.com/kn-cs/x25519
14. Web site: Nath . Kaushik . Sarkar . Palash . Efficient Elliptic Curve Diffie-Hellman Computation at the 256-bit Security Level . IET Information Security, 14(6):633640, 2020., Code available at https://github.com/kn-cs/mont256-dh and https://github.com/kn-cs/mont256-vec
15. Web site: Bernstein . Daniel J. . Lange . Tanja . Safecurves: choosing safe curves for elliptic- curve cryptography . April 15, 2024.
16. Web site: JI. New generation of safe messaging: "Letter Sealing". LINE Engineers' Blog. LINE Corporation. 5 February 2018. 13 October 2015. 1 February 2019. https://web.archive.org/web/20190201120244/https://engineering.linecorp.com/en/blog/detail/65/. dead.