RFC 8031

Curve25519 and Curve448 for the Internet Key Exchange Protocol Version 2 (IKEv2) Key Agreement

📅 published December 2016, from ietf

RFC 8031: Curve25519 and Curve448 for the Internet Key Exchange Protocol Version 2 (IKEv2) Key Agreement ✨

okay bestie, title block first 🎀

Organization: Internet Engineering Task Force (IETF) 🌸
Authors: Y. Nir (Check Point), S. Josefsson, and SJD 👑
Category: Standards Track
ISSN: 2070-1721
Date: December 2016
Obsoletes/Updates: the header doesn't list anything this one obsoletes or updates 🧚

Abstract

this doc explains how to use Curve25519 and Curve448 for ephemeral key exchange in IKEv2 🔑✨

Status of This Memo

this is an Internet Standards Track document 💅

it's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community 🫶 it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). if you want more on Internet Standards, check Section 2 of RFC 7841 🦋

info about the current status of this doc, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc8031 📮

Copyright Notice

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. please review these carefully, because they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 📜💜

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Conventions Used in This Document . . . . . . . . . . . .   2
2.  Curve25519 and Curve448 . . . . . . . . . . . . . . . . . . .   3
3.  Use and Negotiation in IKEv2  . . . . . . . . . . . . . . . .   3
  3.1.  Key Exchange Payload  . . . . . . . . . . . . . . . . . .   4
  3.2.  Recipient Tests . . . . . . . . . . . . . . . . . . . . .   4
4.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   5
  6.1.  Normative References  . . . . . . . . . . . . . . . . . .   5
  6.2.  Informative References  . . . . . . . . . . . . . . . . .   6
Appendix A.  Numerical Example for Curve25519 . . . . . . . . . .   7
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   8
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8

1. Introduction ✨

okay so the "Elliptic Curves for Security" doc [RFC7748] describes two elliptic curves, Curve25519 and Curve448, plus the X25519 and X448 functions for doing key agreement with Diffie-Hellman operations on these curves 💖 they're built for both performance AND security, which is iconic 😭

elliptic curve Diffie-Hellman [RFC5903] has been specified for the Internet Key Exchange Protocol Version 2 (IKEv2) [RFC7296] for almost ten years 🕰️ RFC 5903 and its predecessor specified the so-called NIST curves. the state of the art has moved on since then 🦋 newer curves allow faster implementations, and they make it way easier to write constant-time implementations that hold up against time-based side-channel attacks. this doc defines two of those curves for use in IKEv2. see [Curve25519] for the speed and security details of the Curve25519 function 🔥

1.1. Conventions Used in This Document

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖💅

2. Curve25519 and Curve448 🌸

implementations of Curve25519 and Curve448 in IKEv2 SHALL follow the steps in this section 🫶 all the cryptographic computations are done with the X25519 and X448 functions defined in [RFC7748]. all the related parameters (like the base point) and the encoding (especially pruning the least/most significant bits and using little-endian encoding) are compliant with [RFC7748] 🎀

so an ephemeral Diffie-Hellman key exchange with Curve25519 or Curve448 goes like this: each party picks a secret key d uniformly at random, then computes the matching public key. below, "X" means either X25519 or X448, and "G" means the matching base point 🧚

   pub_mine = X(d, G)

the parties swap their public keys (see Section 3.1) and then compute a shared secret 🔐

     SHARED_SECRET = X(d, pub_peer)

this shared secret gets used directly as the value called g^ir in Section 2.14 of RFC 7296 💜 it's 32 octets when Curve25519 is used and 56 octets when Curve448 is used ✨

3. Use and Negotiation in IKEv2 👑

the use of Curve25519 and Curve448 in IKEv2 gets negotiated with a Transform Type 4 (Diffie-Hellman group) in the Security Association (SA) payload, in either an IKE_SA_INIT or a CREATE_CHILD_SA exchange 🦋 the value 31 is used for the group defined by Curve25519, and the value 32 is used for the group defined by Curve448 💖

3.1. Key Exchange Payload 🎀

here's the diagram for the Key Exchange payload from Section 3.4 of RFC 7296, copied down for convenience 🫶

                       1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  | Next Payload  |C|  RESERVED   |         Payload Length        |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |   Diffie-Hellman Group Num    |           RESERVED            |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                                                               |
  ~                       Key Exchange Data                       ~
  |                                                               |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

the big details:

Payload Length: for Curve25519, the public key is 32 octets, so the Payload Length field will be 40. for Curve448, the public key is 56 octets, so the Payload Length field will be 64 🧚
the Diffie-Hellman Group Num is 31 for Curve25519 or 32 for Curve448 ✨
the Key Exchange Data is the 32 or 56 octets described in Section 6 of [RFC7748] 💅

3.2. Recipient Tests 🔥

receiving and handling incompatible point formats MUST follow the considerations in Section 5 of [RFC7748]. the big one: receiving entities MUST mask the most-significant bit in the final byte for X25519 (but not X448), and implementations MUST accept non-canonical values. 🚨💀

the MUST in there is doing a LOT of work, so don't skip it 🙈

Part 2 is coming with Security Considerations, IANA Considerations, the References, Appendix A, Acknowledgements, and the Authors' Addresses 🦋💜

Appendix A. Numerical Example for Curve25519 ✨

okay bestie, this is the receipts section 🧾💖 we're gonna walk through a full worked example with actual numbers. Imagine both the initiator and the responder generating their private keys from 32 random octets. As usual in IKEv2 and its extension, we tag initiator values with the suffix _i and responder values with the suffix _r 💅

random_i = 75 1f b4 30 86 55 b4 76 b6 78 9b 73 25 f9 ea 8c
           dd d1 6a 58 53 3f f6 d9 e6 00 09 46 4a 5f 9d 94

random_r = 0a 54 64 52 53 29 0d 60 dd ad d0 e0 30 ba cd 9e
           55 01 ef dc 22 07 55 a1 e9 78 f1 b8 39 a0 56 88

Now these numbers have to get a little glow-up 🦋 They need to be fixed by unsetting some bits as described in Section 5 of RFC 7748. Only the first and last octets of each value are affected, so it's giving minimal edits ✨

fixed_i =  70 1f b4 30 86 55 b4 76 b6 78 9b 73 25 f9 ea 8c
           dd d1 6a 58 53 3f f6 d9 e6 00 09 46 4a 5f 9d 54

fixed_r =  08 54 64 52 53 29 0d 60 dd ad d0 e0 30 ba cd 9e
           55 01 ef dc 22 07 55 a1 e9 78 f1 b8 39 a0 56 48

The actual private keys are considered to be encoded in little-endian format 🌸

d_i = 549D5F4A460900E6D9F63F53586AD1DD8CEAF925739B78B676B4558630B41F70

d_r = 4856A039B8F178E9A1550722DCEF01559ECDBA30E0D0ADDD600D295352645408

Next, the public keys are generated from these using the formula in Section 2. Literally the main character moment 👑

pub_i = X25519(d_i, G) =
              48 d5 dd d4 06 12 57 ba 16 6f a3 f9 bb db 74 f1
              a4 e8 1c 08 93 84 fa 77 f7 90 70 9f 0d fb c7 66

pub_r = X25519(d_r, G) =
              0b e7 c1 f5 aa d8 7d 7e 44 86 62 67 32 98 a4 43
              47 8b 85 97 45 17 9e af 56 4c 79 c0 ef 6e ee 25

And this is the value of the Key Exchange Data field in the Key Exchange payload described in Section 3.1. Then the shared value is calculated as in Section 2, and the result is the SHARED_SECRET 😭🫶

SHARED_SECRET = X25519(d_i, pub_r) = X25519(d_r, pub_i) =
              c7 49 50 60 7a 12 32 7f-32 04 d9 4b 68 25 bf b0
              68 b7 f8 31 9a 9e 37 08-ed 3d 43 ce 81 30 c9 50

Acknowledgements 🎀

Okay, shoutout time 📣 Curve25519 was designed by D. J. Bernstein, and the parameters for Curve448 ("Goldilocks") were defined by Mike Hamburg. The specification of algorithms, wire format, and other considerations are documented in RFC 7748 by Adam Langley, Mike Hamburg, and Sean Turner. Iconic team 🧚

The example in Appendix A was calculated using the master version of OpenSSL, retrieved on August 4th, 2016. ✨

Authors' Addresses 💌

Meet the authors 🌈

Yoav Nir
Check Point Software Technologies Ltd.
5 Hasolelim st.
Tel Aviv  6789735
Israel

Email: ynir.ietf@gmail.com


Simon Josefsson
SJD AB

Email: simon@josefsson.org

📦 where this page comes from

ietf: rfc8031 2016-12
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms