3.11 Curve25519

Curve25519 is a Montgomery curve with desirable cryptographic properties that make it comparatively easy to use safely and reliably. Its points are hexadecimal atoms denoting the u-coordinate, and X25519 (RFC 7748) scalar multiplication is the recommended way to establish a shared secret. See Establishing a shared secret (section 3.12) for the general procedure, which is carried out with the following two predicates:

[det]curve25519_generator(-Generator)

Points on Curve25519 are hexadecimal atoms denoting the u-coordinate of the Montgomery curve. Generator is the generator point of Curve25519.

[semidet]curve25519_scalar_mult(+Scalar, +Point, -Result)

Result is the point Scalar*Point on Curve25519, as mandated by X25519 (RFC 7748). Scalar is an integer between 0 and 2^256-1, or 32 bytes. Fails if Point has small order, i.e., if the result would be the point at infinity.

Alice and Bob can use this to establish a shared secret, where Generator is obtained with curve25519_generator/1:

1. Alice creates a random integer a and sends As = a*Generator to Bob.
2. Bob creates a random integer b and sends Bs = b*Generator to Alice.
3. Alice computes Rs = a*Bs.
4. Bob computes Rs = b*As.
5. Alice and Bob use crypto_data_hkdf/4 on Rs with suitable (same) parameters to obtain keys and initialization vectors for symmetric encryption.

If a and b are kept secret, this method is considered very secure.