libgcrypt: Add a curve name for ietf25 defined in RFC9580
Closed, ResolvedPublic

Assigned To
Authored By
gniibe
Thu, Aug 6, 3:37 AM

Description

In libgcrypt, "Curve25519" is a bit difficult to use, because of historical use case (still supported) for non-standard signature generation and verification.

  • For use of ECDH encryption (compatible to X25519), it requires (flags djb-tweak) for key to distinguish the historical use case
  • For use of ECDH encryption, secret key is encoded in standard (big-endian) MPI. Application should take care of this. (Different to X25519).

"X448" curve was introduced after X448, and no historical use cases, so, it has no problem.
It is easier to introduce new curve name, say, ietf25 for X25519, that is, no requirement of flags, with compatible key endian.

(Possibly, ietf27 would be also useful for Ed25519.)

Related Objects