Re: [Cfrg] Curve25519 specification, test vectors, etc.

[CodesInChaos <[e-mail]>]

Two potential pitfalls for a Curve25519 implementation:

* Parsing non standard public keys where the most significant bit is set.

  The Curve25519 spec requires parsing the input as a 256 bit integer
which is then reduced mod p.
  Some implementations parse it as 255 bit integer, ignoring the last
bit. (Similar to the way Ed25519 parses its public keys).

  Older versions of Curve25519-donna and LibSodium had this flaw. See
https://github.com/jedisct1/libsodium/issues/78 for details.

  I suggest adding a test vector for the public key with all bits set.

* The shared secret gets hashed with (H)Salsa20.

  The hashing differs between the original Curve25519 paper and NaCl.
  The Curve25519 paper specifies a hash based on Salsa20 with custom constants
  The NaCl paper specifies HSalsa20 (i.e. without xor-ing the input)
with standard constants and an all zero nonce.

  I have only seen the NaCl variant in practice.