Meta tags:
description=An explanation and demonstration of Curve25519 Key Exchange;

Headings (most frequently used words):

on, hands, exchange, x25519, key, overview, math, the, curve, odds, and, ends, let, secret, to, start, secure, conversation,

Text of the page (most frequently used words):
the (57), key (36), curve (18), and (18), secret (18), point (16), for (12), public (12), alice (12), bob (12), #x25519 (11), with (10), can (9), points (9), multiplication (8), are (8), that (8), exchange (8), this (7), use (7), curve25519 (6), addition (6), give (6), coordinate (6), calculator (6), keys (6), let (6), bits (5), elliptic (5), above (5), numbers (5), number (5), adding (5), section (4), you (4), operations (4), 486662x (4), 255 (4), what (4), two (4), not (4), find (4), same (4), which (4), result (4), found (3), see (3), montgomery (3), arithmetic (3), animated (3), modular (3), math (3), like (3), only (3), values (3), valid (3), results (3), they (3), these (3), where (3), byte (3), used (3), 256 (3), multiply (3), shared (3), hands (3), gives (3), strength (2), details (2), clamping (2), cryptography (2), implementing (2), algorithm (2), wikipedia (2), new (2), here (2), when (2), using (2), looks (2), does (2), our (2), equation (2), has (2), satisfy (2), each (2), coordinates (2), needed (2), match (2), because (2), order (2), page (2), them (2), actual (2), five (2), other (2), from (2), base (2), would (2), one (2), peer (2), those (2), eavesdropper (2), put (2), into (2), 35p (2), multiplier (2), such (2), some (2), scalar (2), division (2), mod23 (2), 10mod23 (2), multiplicative (2), inverse (2), prime (2), will (2), secure (2), bit (2), random (2), doing (2), tls (2), code, project, github, makes, 251, further, martin, kleppmann, gentle, introduction, noted, pdf, recommended, constant, time, ladder, rfc, 7748, includes, equations, doubling, particularly, ladders, exploration, concepts, behind, explains, how, was, derived, diffie, hellman, speed, records, following, useful, more, first, calculated, integers, real, floating, standard, look, half, going, back, means, expression, square, root, side, sqrt, simplicity, computed, also, reduces, length, isn, part, may, still, your, output, stored, transmitted, little, endian, while, displays, plain, flipping, should, private, exchanges, modified, slightly, need, set, clear, yourself, any, why, reproduce, tools, openssl, constrain, prevents, reaching, infinity, prevent, implementors, skipping, round, smaller, expose, timing, leak, 254, protect, against, small, subgroup, attacks, allow, manipulated, discover, reason, value, size, bytes, but, clamped, fixed, address, various, security, concerns, odds, ends, since, either, compute, switch, over, matches, 1b9b715c415e547a13ca98a9f561d54499cc7402a1098414eddcfaf83ffbe3f8, now, below, 41b6ec3c50ee7af203c0026e5e079e7fa8cbc9bc581d49cb0d537d5778497c87, 0daf32e7ed8099122b2dfa4c1d8c4a20c0972a1538bf0575338aae0fe0841828, perform, simple, different, clamp, play, lets, calculations, 28mod23, subtraction, 5mod23, 31mod23, examples, replaced, instead, dividing, satisfies, relationship, field, subtracting, multiplying, wrap, around, calculating, component, individually, associative, repeated, additions, etc, third, based, line, between, its, intersection, performed, skipped, just, flavor, curves, depth, explanation, sister, once, have, build, encryption, connection, terms, better, names, mechanism, parties, agree, without, being, able, tell, name, method, overview, start, conversation, dtls, quic,

Text of the page (random words):
hands on x25519 key exchange quic dtls tls 1 3 tls 1 2 hands on x25519 key exchange let s exchange a secret to start a secure conversation overview key exchange is a mechanism where two parties alice and bob can agree on the same number without an eavesdropper being able to tell what it is x25519 is the name of one method of key exchange by doing point operations on the curve25519 elliptic curve y 2 x 3 486662x 2 x with those point operations we ll be doing a key exchange that looks like this k b k a p k a k b p let s give the above terms some better names k a alice s secret key a 256 bit 32 byte random number k b bob s secret key a 256 bit 32 byte random number p a point on the curve where x 9 k a p alice s public key k b p bob s public key k a k b p the shared secret once alice and bob have a shared secret they can use it to build encryption keys for a secure connection math on the curve this section can be skipped it just gives a flavor of the math of elliptic curves an in depth animated explanation for this section can be found on a sister page point operations performed on points on the curve adding two points on the curve gives a third point based on the line between two points and its intersection with the curve repeated additions of a point on the curve gives us scalar multiplication 2p p p 3p p p p 6p p p p p p p etc adding points on the curve is associative adding the results of point addition will give the same result as adding the component points individually p p p p 3p p 2p 2p 4p point addition p q r modular arithmetic used when calculating addition and multiplication of points above adding subtracting and multiplying numbers will wrap around at the prime p 2 255 19 division is replaced with the multiplicative inverse instead of dividing by x we find the number x 1 that satisfies the relationship x x 1 1 in our prime field and multiply by that examples with p 23 addition 16 15 31mod23 8 subtraction 8 13 5mod23 18 multiplication 4 7 28mod23 5 multiplicative inverse 7 7 1 mod23 1 7 10mod23 1 7 1 10 division 4 7 4 7 1 mod23 4 10mod23 17 hands on let s play with some actual numbers this calculator lets us do scalar multiplication on the base point p which is a point on the curve with coordinate x 9 these calculations only give the x coordinate of np the y coordinate is not needed or used secret key multiplier 1 x2 clamp secret key n public key np let s perform a simple key exchange give alice a secret key such as 7 and use the calculator above to find alice s public key give bob a different secret key such as 5 and use the calculator to find bob s public key alice s secret key k a 7 alice s public key k a p 7p 0daf32e7ed8099122b2dfa4c1d8c4a20c0972a1538bf0575338aae0fe0841828 bob s secret key k b 5 bob s public key k b p 5p 41b6ec3c50ee7af203c0026e5e079e7fa8cbc9bc581d49cb0d537d5778497c87 now let s be alice put alice s secret key k a into the calculator below and use it to multiply bob s public key k b p shared secret k a k b p 35p 1b9b715c415e547a13ca98a9f561d54499cc7402a1098414eddcfaf83ffbe3f8 public key multiplier secret key n public key q new point nq let s switch over to bob put bob s secret key k b into the calculator and use it to multiply alice s public key k a p the result matches because k a k b p k b k a p 35p since the eavesdropper can t see either of alice or bob s secret keys they can t compute the same result odds and ends q what is the key strength of x25519 a the key size of x25519 is 256 bits 32 bytes but five of those bits are clamped to fixed values to address various security concerns bits value reason 0 1 2 0 protect against small subgroup attacks which would allow one peer to use a manipulated secret key to discover the other peer s secret key 254 1 prevent implementors from skipping a multiplication round for smaller keys which would expose a timing leak 255 0 constrain n 255 which prevents the algorithm from reaching the infinity result for base point x 9 this makes a key with strength 251 bits for further details see section 4 7 clamping in implementing curve25519 x25519 by martin kleppmann q why can t i reproduce these results in openssl or other tools a private keys used in actual x25519 exchanges are modified slightly see clamping above and you ll need to set clear the same five bits yourself on any keys that you use for key exchange you may still find that your output does not match because x25519 keys are stored and transmitted in little endian order while this page displays them as plain numbers flipping the byte order should match them up q if these are points in an x y curve where are the y coordinates a the y coordinates for each point are not needed for x25519 and for simplicity they are not computed using only the x coordinate also reduces public key length as the y coordinate isn t part of the key each valid point on the curve has two y values that satisfy sqrt y 2 y coordinate calculator x y 1 y 2 only half of x values are valid on curve25519 going back to our curve equation valid means that the expression x 3 486662x 2 x results in a number that in modular arithmetic has a square root to satisfy the y 2 side of the equation q what does curve25519 look like a here s what the curve looks like in real numbers i e floating point numbers with standard addition and multiplication y 2 x 3 486662x 2 x and here s the first points of the curve when calculated in 𝔽 p i e with integers 0 2 255 19 using modular math y 2 x 3 486662x 2 x in 𝔽 p q can you give me more details on elliptic curve operations a i found the following useful curve25519 new diffie hellman speed records explains the curve and how it was derived the animated elliptic curve an animated exploration of the concepts behind ec cryptography wikipedia ec point multiplication particularly the section on montgomery ladders wikipedia montgomery arithmetic includes equations for addition and doubling of points rfc 7748 recommended algorithm for x25519 multiplication in constant time with a montgomery ladder pdf implementing curve25519 x25519 as noted above elliptic curve cryptography a gentle introduction the code for this project can be found on github