Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448
Extracted elements (16)
Curve448-sha512 is included as a hedge to combat unforeseen analytical advances against Curve25519 and SHA-256, providing more than 128 bits of security strength. "curve25519-sha256" is the preferred choice, but "curve448-sha512" is recommended for implementation.
The shared secret encoding in Section 3.1 differs from RFC 5656, which uses a different conversion. Curve25519/448 outputs are in little-endian (per RFC 7748) but are reinterpreted as big-endian unsigned integers before mpint encoding for SSH key derivation. This is intentional and scoped only to this document's mechanisms.
The "curve25519-sha256" method defined here is equivalent to the privately defined "[email protected]" algorithm that was already widely deployed in libssh and OpenSSH at the time of publication.
This document reuses the ECDH key exchange protocol messages defined in Section 7.1 of RFC 5656 (ECDH Message Numbers), but does not use ECMQV or ECDSA from RFC 5656.
Alternative implementations of X25519/X448 SHOULD abort when either the client or the server input forces the shared secret to one of a small set of values, as described in Sections 6 and 7 of RFC 7748.
An abort is defined as a disconnect (SSH_MSG_DISCONNECT) of the session and SHOULD use the SSH_DISCONNECT_KEY_EXCHANGE_FAILED reason code.
Clients and servers MUST abort if the length of the received public keys are not the expected lengths (32 bytes for Curve25519, 56 bytes for Curve448).
Implementations SHOULD compute X25519 and X448 functions using the algorithms described in RFC 7748.
When using RFC 7748 algorithms, implementations MUST check whether the computed Diffie-Hellman shared secret is the all-zero value and abort if so, as described in Section 6 of RFC 7748.
The protocol flow and the SSH_MSG_KEX_ECDH_INIT and SSH_MSG_KEX_ECDH_REPLY messages and the structure of the exchange hash are identical to Section 4 of RFC 5656. The derived shared secret is 32 bytes for "curve25519-sha256" and 56 bytes for "curve448-sha512".
Two key exchange method names are defined: "curve25519-sha256" (using Curve25519 and SHA-256) and "curve448-sha512" (using Curve448 and SHA-512). These are registered in the SSH Key Exchange Method Names registry.
IANA added "curve25519-sha256" and "curve448-sha512" to the "Key Exchange Method Names" registry for SSH, which was originally created in Section 4.10 of RFC 4250.
Curve25519 with SHA-256 provides strong (~128 bits) security and is efficient on a wide range of architectures. Curve448 with SHA-512 provides stronger (~224 bits) security but has not received the same level of cryptographic review as Curve25519 and is slower.
The mpint encoding of the shared secret (which may add or remove zero bytes) raises the potential for a side-channel attack that could determine the length of what is hashed, leaking the most significant bit of the derived secret. For backwards-compatibility reasons, this potential problem was not addressed.
Public ephemeral keys are encoded for transmission as standard SSH strings. Public keys are fixed-length byte strings: 32 bytes for Curve25519 and 56 bytes for Curve448.
The shared secret K is derived by taking the 32 or 56 bytes output from X25519/X448 and interpreting the octets as an unsigned fixed-length integer encoded in network byte order (big-endian), then encoding that integer as an SSH mpint per RFC 4251 Section 5.