ECDH (Elliptic Curve Diffie-Hellman) Reference
Reference for elliptic curve Diffie-Hellman key agreement, including X25519 and static/ephemeral variants.
Key Agreement Protocol
ECDH allows two parties to establish a shared secret over an insecure channel using elliptic curve scalar multiplication. Each party generates a key pair and exchanges public keys; the shared secret is computed by multiplying the received public key by the own private key. The security relies on the Computational Diffie-Hellman (CDH) assumption on the curve. The shared secret is typically fed to a KDF to derive symmetric keys.
- shared secret
- Both compute same point
- CDH assumption
- Computational hardness
- KDF
- Derive keys from secret
a*(bP) = b*(aP)no efficient solverHKDF-SHA256Variants and Best Practices
Ephemeral ECDH (ECDHE) generates fresh key pairs per session for forward secrecy. Static ECDH reuses long-term keys, losing forward secrecy but enabling identity binding. X25519 uses Montgomery ladder scalar multiplication with complete, constant-time formulas and cofactor handling. Key validation (point on curve, correct subgroup) prevents invalid-curve attacks. TLS 1.3 mandates ephemeral key exchange.
- ECDHE
- Ephemeral, forward secrecy
- X25519
- Montgomery ladder
- validation
- Check point on curve
TLS 1.3 defaultRFC 7748prevent invalid-curve