1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176

"""
Elliptic Curve Fundamentals for Cryptography
 
This demonstrates the core operations that make EC cryptography work.
"""
 
from dataclasses import dataclass
from typing import Optional, Tuple
 
@dataclass(frozen=True)
class Point:
    """A point on an elliptic curve."""
    x: Optional[int]  # None for point at infinity
    y: Optional[int]
    
    def is_infinity(self) -> bool:
        return self.x is None and self.y is None
    
    def __repr__(self) -> str:
        if self.is_infinity():
            return "O (point at infinity)"
        return f"({self.x}, {self.y})"
 
 
# Point at infinity (identity element)
INFINITY = Point(None, None)
 
 
class EllipticCurve:
    """
    Elliptic curve over a prime field: y² = x³ + ax + b (mod p)
    
    This is a simplified educational implementation.
    Production code must use constant-time operations.
    """
    
    def __init__(self, a: int, b: int, p: int):
        """
        Initialize curve with parameters.
        
        Args:
            a, b: Curve coefficients
            p: Prime modulus (size of the field)
        """
        self.a = a
        self.b = b
        self.p = p
        
        # Verify curve is non-singular
        discriminant = (4 * pow(a, 3, p) + 27 * pow(b, 2, p)) % p
        assert discriminant != 0, "Singular curve (discriminant = 0)"
    
    def is_on_curve(self, point: Point) -> bool:
        """Check if a point lies on the curve."""
        if point.is_infinity():
            return True
        
        left = pow(point.y, 2, self.p)
        right = (pow(point.x, 3, self.p) + self.a * point.x + self.b) % self.p
        return left == right
    
    def add(self, P: Point, Q: Point) -> Point:
        """
        Add two points on the elliptic curve.
        
        This is the core operation. Addition has these cases:
        1. P = O or Q = O: Return the other point
        2. P = -Q: Return O (point at infinity)
        3. P ≠ Q: "Chord" rule - draw line through P,Q
        4. P = Q: "Tangent" rule - use tangent at P
        
        In each case, the third intersection point (or its reflection)
        gives the result.
        """
        # Case 1: Identity element
        if P.is_infinity():
            return Q
        if Q.is_infinity():
            return P
        
        # Case 2: Point and its inverse (P + (-P) = O)
        if P.x == Q.x and (P.y + Q.y) % self.p == 0:
            return INFINITY
        
        # Case 3 & 4: Compute slope
        if P.x == Q.x and P.y == Q.y:
            # Point doubling: tangent slope = (3x² + a) / (2y)
            numerator = (3 * pow(P.x, 2, self.p) + self.a) % self.p
            denominator = (2 * P.y) % self.p
        else:
            # Point addition: chord slope = (y2 - y1) / (x2 - x1)
            numerator = (Q.y - P.y) % self.p
            denominator = (Q.x - P.x) % self.p
        
        # Compute slope using modular inverse
        slope = (numerator * pow(denominator, -1, self.p)) % self.p
        
        # Compute new point
        x3 = (pow(slope, 2, self.p) - P.x - Q.x) % self.p
        y3 = (slope * (P.x - x3) - P.y) % self.p
        
        return Point(x3, y3)
    
    def multiply(self, k: int, P: Point) -> Point:
        """
        Scalar multiplication: compute k * P = P + P + ... + P (k times)
        
        Uses double-and-add algorithm for efficiency.
        
        CRITICAL FOR ECDH:
        - Public key = k * G where k is private key, G is generator
        - k * P is easy to compute
        - Finding k given P and k*P is the EC discrete log problem
        """
        if k == 0 or P.is_infinity():
            return INFINITY
        
        if k < 0:
            k = -k
            P = Point(P.x, (-P.y) % self.p)
        
        result = INFINITY
        addend = P
        
        while k > 0:
            if k & 1:  # If bit is set
                result = self.add(result, addend)
            addend = self.add(addend, addend)  # Point doubling
            k >>= 1
        
        return result
 
 
# Example: secp256k1 parameters (used in Bitcoin)
# This is a small demo - real secp256k1 uses 256-bit numbers
def demo_curve():
    """Demonstrate elliptic curve operations on a small curve."""
    
    # Small demonstration curve: y² = x³ + 7 (mod 67)
    curve = EllipticCurve(a=0, b=7, p=67)
    
    # Find points on the curve
    print("Points on curve y² = x³ + 7 (mod 67):")
    points = []
    for x in range(67):
        y_squared = (pow(x, 3, 67) + 7) % 67
        # Check if y_squared is a quadratic residue
        for y in range(67):
            if pow(y, 2, 67) == y_squared:
                point = Point(x, y)
                if curve.is_on_curve(point):
                    points.append(point)
    
    print(f"  Found {len(points)} points (plus point at infinity)")
    
    # Demonstrate addition
    if len(points) >= 2:
        P, Q = points[0], points[1]
        R = curve.add(P, Q)
        print(f"
  P = {P}")
        print(f"  Q = {Q}")
        print(f"  P + Q = {R}")
        print(f"  R on curve: {curve.is_on_curve(R)}")
    
    # Demonstrate scalar multiplication
    G = points[0]  # Use first point as "generator"
    k = 7  # Scalar
    kG = curve.multiply(k, G)
    print(f"
  G = {G}")
    print(f"  7 * G = {kG}")
    print(f"  7G on curve: {curve.is_on_curve(kG)}")
 
 
demo_curve()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

"""
Elliptic Curve Diffie-Hellman (ECDH) Implementation
 
This demonstrates the complete ECDH key exchange protocol.
For production, use established libraries like cryptography or libsodium.
"""
 
import secrets
import hashlib
from dataclasses import dataclass
from typing import Tuple
 
# Reuse EllipticCurve and Point classes from earlier
# (In practice, use a well-audited implementation)
 
@dataclass
class ECDHParameters:
    """ECDH domain parameters."""
    curve: 'EllipticCurve'  # The curve
    G: 'Point'              # Generator (base point)
    n: int                  # Order of G (number of points in subgroup)
    h: int                  # Cofactor
 
@dataclass
class ECDHKeyPair:
    """An ECDH key pair."""
    private_key: int        # The secret scalar d
    public_key: 'Point'     # Q = d × G
 
class ECDH:
    """
    Elliptic Curve Diffie-Hellman key exchange.
    
    Security relies on the Elliptic Curve Discrete Log Problem (ECDLP):
    Given G and Q = d × G, finding d is computationally infeasible.
    """
    
    def __init__(self, params: ECDHParameters):
        self.params = params
    
    def generate_keypair(self) -> ECDHKeyPair:
        """
        Generate a new ECDH key pair.
        
        Private key: Random integer d ∈ [1, n-1]
        Public key: Q = d × G
        """
        # Generate private key: random scalar
        # CRITICAL: Must use cryptographically secure RNG
        d = secrets.randbelow(self.params.n - 1) + 1
        
        # Compute public key: scalar multiplication
        Q = self.params.curve.multiply(d, self.params.G)
        
        return ECDHKeyPair(private_key=d, public_key=Q)
    
    def compute_shared_secret(self, my_private: int, other_public: 'Point') -> bytes:
        """
        Compute the shared secret from my private key and peer's public key.
        
        S = my_private × other_public
          = d_A × Q_B
          = d_A × (d_B × G)
          = (d_A × d_B) × G
        
        Both parties compute the same point S.
        The x-coordinate of S is the raw shared secret.
        """
        # Validate public key is on curve (CRITICAL!)
        if not self.params.curve.is_on_curve(other_public):
            raise ValueError("Invalid public key: not on curve")
        
        # Validate public key is in correct subgroup
        if other_public.is_infinity():
            raise ValueError("Invalid public key: point at infinity")
        
        # Check that n × other_public = O (correct order)
        check = self.params.curve.multiply(self.params.n, other_public)
        if not check.is_infinity():
            raise ValueError("Invalid public key: wrong order")
        
        # Compute shared secret point
        S = self.params.curve.multiply(my_private, other_public)
        
        if S.is_infinity():
            raise ValueError("Computed shared secret is point at infinity")
        
        # Extract x-coordinate and derive key
        # NEVER use raw x directly; always apply KDF
        shared_x = S.x.to_bytes((S.x.bit_length() + 7) // 8, 'big')
        
        # Key derivation (simplified; use HKDF in production)
        derived_key = hashlib.sha256(shared_x).digest()
        
        return derived_key
 
 
def ecdh_demo():
    """
    Demonstrate complete ECDH key exchange.
    
    Using a small curve for demonstration.
    Real systems use P-256, P-384, X25519, or X448.
    """
    print("ECDH KEY EXCHANGE DEMONSTRATION")
    print("=" * 60)
    
    # Small demonstration curve: y² = x³ + 2x + 3 (mod 97)
    # In practice, use standardized curves like secp256r1
    curve = EllipticCurve(a=2, b=3, p=97)
    
    # Find a generator point (simplified; real curves specify this)
    G = Point(3, 6)  # Verified to be on this curve
    assert curve.is_on_curve(G)
    
    # Assuming order n = 89 (would need to verify for real curve)
    # Cofactor h = 1
    params = ECDHParameters(curve=curve, G=G, n=89, h=1)
    
    # Create ECDH instances
    alice_ecdh = ECDH(params)
    bob_ecdh = ECDH(params)
    
    print(f"
Curve: y² = x³ + {curve.a}x + {curve.b} (mod {curve.p})")
    print(f"Generator G = {G}")
    print(f"Order n = {params.n}")
    
    # Generate key pairs
    print("
--- KEY GENERATION ---")
    alice_keys = alice_ecdh.generate_keypair()
    bob_keys = bob_ecdh.generate_keypair()
    
    print(f"Alice: private = {alice_keys.private_key}, public = {alice_keys.public_key}")
    print(f"Bob:   private = {bob_keys.private_key}, public = {bob_keys.public_key}")
    
    # Exchange public keys and compute shared secrets
    print("
--- SHARED SECRET COMPUTATION ---")
    
    alice_secret = alice_ecdh.compute_shared_secret(
        alice_keys.private_key, 
        bob_keys.public_key
    )
    bob_secret = bob_ecdh.compute_shared_secret(
        bob_keys.private_key,
        alice_keys.public_key
    )
    
    print(f"Alice computes: {alice_keys.private_key} × {bob_keys.public_key}")
    print(f"Bob computes:   {bob_keys.private_key} × {alice_keys.public_key}")
    
    print(f"
Alice's derived key: {alice_secret.hex()[:32]}...")
    print(f"Bob's derived key:   {bob_secret.hex()[:32]}...")
    
    # Verify they match
    assert alice_secret == bob_secret
    print("
✓ Shared secrets match!")
    
    print("
--- SECURITY NOTE ---")
    print("An eavesdropper sees only G, Alice's public key, and Bob's public key.")
    print("Computing the shared secret requires solving ECDLP.")
    print("=" * 60)
 
 
# Run demo (requires EllipticCurve and Point classes from earlier)
# ecdh_demo()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

"""
Comparing Popular Elliptic Curves
 
This illustrates the different characteristics and use cases
of commonly used elliptic curves.
"""
 
# Note: These parameters are the actual values from standards
# For real implementations, use cryptographic libraries
 
curves = {
    "P-256 (secp256r1)": {
        "field_size": 256,
        "security_bits": 128,
        "form": "Short Weierstrass: y² = x³ - 3x + b",
        "field_prime": "2²⁵⁶ - 2²²⁴ + 2¹⁹² + 2⁹⁶ - 1",
        "advantages": [
            "Widespread hardware support (Intel, ARM)",
            "NIST/FIPS approved",
            "Required for many compliance standards",
        ],
        "disadvantages": [
            "Complex implementation",
            "Timing attack risks if coded carelessly",
            "Seed origin concerns (probably unfounded)",
        ],
        "use_cases": [
            "TLS (ECDHE-ECDSA, ECDHE-RSA)",
            "FIDO2/WebAuthn",
            "Code signing (Apple, Microsoft)",
            "Government/military systems",
        ],
    },
    
    "X25519 (Curve25519)": {
        "field_size": 255,
        "security_bits": 128,
        "form": "Montgomery: y² = x³ + 486662x² + x",
        "field_prime": "2²⁵⁵ - 19",
        "advantages": [
            "Extremely fast implementation",
            "Naturally constant-time",
            "Twist-secure (invalid points leak nothing)",
            "Simple, less error-prone to implement",
            "Fully specified—no unexplained seeds",
        ],
        "disadvantages": [
            "Not FIPS approved (until recently)",
            "No native signing (use Ed25519 for that)",
        ],
        "use_cases": [
            "TLS 1.3 (default in many implementations)",
            "Signal Protocol / WhatsApp",
            "WireGuard VPN",
            "SSH (modern versions)",
            "Tor",
        ],
    },
    
    "secp256k1": {
        "field_size": 256,
        "security_bits": 128,
        "form": "Short Weierstrass: y² = x³ + 7",
        "field_prime": "2²⁵⁶ - 2³² - 977",
        "advantages": [
            "Simple equation (a = 0)",
            "Efficient implementation possible",
            "Well-studied in blockchain context",
        ],
        "disadvantages": [
            "Chosen for efficiency, not security margin",
            "Not NIST approved",
            "Narrower use case",
        ],
        "use_cases": [
            "Bitcoin signatures",
            "Ethereum and most blockchains",
            "Cryptocurrency wallets",
        ],
    },
}
 
def print_curve_info():
    """Display curve comparison information."""
    print("ELLIPTIC CURVE COMPARISON")
    print("=" * 70)
    
    for name, info in curves.items():
        print(f"
{'─' * 70}")
        print(f"📈 {name}")
        print(f"{'─' * 70}")
        print(f"  Field size: {info['field_size']} bits")
        print(f"  Security: ~{info['security_bits']}-bit")
        print(f"  Form: {info['form']}")
        print(f"  Prime: {info['field_prime']}")
        
        print("
  ✓ Advantages:")
        for adv in info['advantages']:
            print(f"    • {adv}")
        
        print("
  ✗ Disadvantages:")
        for dis in info['disadvantages']:
            print(f"    • {dis}")
        
        print("
  📋 Use Cases:")
        for use in info['use_cases']:
            print(f"    • {use}")
 
print_curve_info()
 
print("
" + "=" * 70)
print("RECOMMENDATION:")
print("  • New applications: Use X25519 (key exchange) + Ed25519 (signatures)")
print("  • Compliance required: Use P-256 or P-384")
print("  • Blockchain: Use secp256k1 (for compatibility)")
print("  • Maximum security: Use X448 or P-384")
print("=" * 70)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

"""
ECDH Security Considerations and Mitigations
 
This demonstrates common vulnerabilities and how to prevent them.
"""
 
class SecureECDH:
    """
    ECDH with security best practices.
    
    This is an educational skeleton showing what checks are needed.
    """
    
    def __init__(self, curve_params):
        self.curve = curve_params['curve']
        self.G = curve_params['G']
        self.n = curve_params['n']  # Order
        self.h = curve_params['h']  # Cofactor
    
    def validate_public_key(self, Q: 'Point') -> bool:
        """
        Comprehensive public key validation.
        
        CRITICAL: All of these checks must pass before using a public key.
        Skipping any check can lead to attacks.
        """
        # CHECK 1: Not the point at infinity
        if Q.is_infinity():
            raise ValueError("Public key is point at infinity")
        
        # CHECK 2: Coordinates are in valid range
        if not (0 <= Q.x < self.curve.p and 0 <= Q.y < self.curve.p):
            raise ValueError("Public key coordinates out of range")
        
        # CHECK 3: Point is on the curve
        if not self.curve.is_on_curve(Q):
            raise ValueError("Public key is not on curve (invalid curve attack)")
        
        # CHECK 4: Point has correct order (for curves with cofactor > 1)
        # Ensures Q is in the correct subgroup
        if self.h > 1:
            # Check that n * Q = O (point at infinity)
            nQ = self.curve.multiply(self.n, Q)
            if not nQ.is_infinity():
                raise ValueError("Public key has incorrect order")
        
        # CHECK 5: For X25519, also verify Q is not a low-order point
        # This is handled by curve design but good to check
        
        return True
    
    def constant_time_multiply(self, k: int, P: 'Point') -> 'Point':
        """
        Constant-time scalar multiplication to prevent timing attacks.
        
        Montgomery ladder is naturally constant-time.
        For Weierstrass curves, requires careful implementation.
        """
        # Use Montgomery ladder or equivalent
        # The key principle: every iteration takes the same time
        # regardless of the bits of k
        
        # Pseudocode for Montgomery ladder:
        # R0 = O, R1 = P
        # for i in range(num_bits, -1, -1):
        #     if bit(k, i) == 0:
        #         R1 = R0 + R1
        #         R0 = 2 * R0
        #     else:
        #         R0 = R0 + R1
        #         R1 = 2 * R1
        # return R0
        
        # In practice, use conditional swaps to avoid branching
        pass
    
    def cofactor_multiplication(self, S: 'Point') -> 'Point':
        """
        Multiply by cofactor to ensure shared secret is in main subgroup.
        
        For curves with h > 1, compute h * S before deriving key.
        This prevents small subgroup attacks even without full validation.
        """
        return self.curve.multiply(self.h, S)
    
    def compute_shared_secret_secure(self, my_private: int, 
                                      other_public: 'Point') -> bytes:
        """
        Secure shared secret computation with all mitigations.
        """
        # Step 1: Validate public key (prevents invalid curve attacks)
        self.validate_public_key(other_public)
        
        # Step 2: Constant-time scalar multiplication (prevents timing)
        S = self.constant_time_multiply(my_private, other_public)
        
        # Step 3: Cofactor multiplication (prevents small subgroup)
        S = self.cofactor_multiplication(S)
        
        # Step 4: Check result is not identity
        if S.is_infinity():
            raise ValueError("Shared secret is point at infinity")
        
        # Step 5: Apply KDF to extract uniform key material
        import hashlib
        import hmac
        
        # Use HKDF for proper key derivation
        raw_secret = S.x.to_bytes((S.x.bit_length() + 7) // 8, 'big')
        
        # HKDF-Extract
        salt = b'\x00' * 32  # Or random salt
        prk = hmac.new(salt, raw_secret, hashlib.sha256).digest()
        
        # HKDF-Expand (simplified)
        info = b'ECDH shared secret'
        okm = hmac.new(prk, info + b'\x01', hashlib.sha256).digest()
        
        return okm
 
 
print("ECDH SECURITY CHECKLIST")
print("=" * 60)
print("""
✓ Validate public keys before use:
  - Not point at infinity
  - Coordinates in range [0, p-1]  
  - Point lies on correct curve
  - Point has correct order (for cofactor > 1)
 
✓ Use constant-time operations:
  - Montgomery ladder for scalar multiplication
  - No branching on secret values
  - Regular memory access patterns
 
✓ Apply cofactor multiplication:
  - Compute h × S before key derivation
  - Required for curves with h > 1
 
✓ Use proper key derivation:
  - Never use raw x-coordinate directly
  - Apply HKDF or similar KDF
  - Include context/info in derivation
 
✓ Handle errors safely:
  - Don't leak which check failed
  - Clear sensitive data on error
  - Use secure memory erasure
""")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

"""
TLS 1.3 ECDHE Key Exchange Flow
 
This illustrates how ECDH fits into the TLS 1.3 handshake.
"""
 
def tls13_ecdhe_overview():
    """
    Overview of TLS 1.3 handshake with ECDHE.
    """
    print("TLS 1.3 ECDHE KEY EXCHANGE")
    print("=" * 65)
    
    print("""
┌─────────┐                                           ┌─────────┐
│ Client  │                                           │ Server  │
└────┬────┘                                           └────┬────┘
     │                                                     │
     │ ClientHello                                         │
     │   • Supported versions: TLS 1.3                     │
     │   • Cipher suites: TLS_AES_128_GCM_SHA256, ...     │
     │   • Supported groups: x25519, secp256r1, ...       │
     │   • Key shares: x25519_public_key, p256_public_key │
     │ ──────────────────────────────────────────────────► │
     │                                                     │
     │                  [ Server receives, validates ]     │
     │                  [ Chooses x25519, generates key ]  │
     │                  [ Computes shared secret ]         │
     │                                                     │
     │                                    ServerHello      │
     │   • Selected: x25519                                │
     │   • Key share: x25519_public_key (server's)        │
     │ ◄────────────────────────────────────────────────── │
     │                                                     │
     │ [ Client computes shared secret ]                   │
     │ [ Both derive handshake keys ]                      │
     │                                                     │
     │                     EncryptedExtensions            │
     │                     Certificate                     │
     │                     CertificateVerify              │
     │                     Finished                        │
     │ ◄────────────────────────────────────────────────── │
     │                                                     │
     │ Finished                                            │
     │ ──────────────────────────────────────────────────► │
     │                                                     │
     │ [ APPLICATION DATA, encrypted with session keys ]   │
     │ ◄────────────────────────────────────────────────► │
     │                                                     │
 
KEY DERIVATION (simplified):
 
  1. ECDHE Shared Secret = x25519(client_private, server_public)
                        = x25519(server_private, client_public)
  
  2. Early Secret = HKDF-Extract(salt=0, input=0)
  
  3. Handshake Secret = HKDF-Extract(Early Secret, ECDHE Shared Secret)
  
  4. Client/Server Handshake Keys = HKDF-Expand(Handshake Secret, ...)
  
  5. Master Secret = HKDF-Extract(Handshake Secret, 0)
  
  6. Client/Server Application Keys = HKDF-Expand(Master Secret, ...)
""")
 
    print("\nKEY POINTS:")
    print("  • Client sends key share speculatively (1-RTT optimization)")
    print("  • Server chooses curve + sends its key share")
    print("  • Both independently compute same shared secret")
    print("  • Shared secret feeds into HKDF-based key schedule")
    print("  • Result: authenticated encryption keys for application data")
    print("=" * 65)
 
 
def wireguard_ecdh_overview():
    """
    Overview of WireGuard's ECDH usage.
    """
    print("\nWIREGUARD X25519 USAGE")
    print("=" * 65)
    
    print("""
WireGuard uses X25519 in the Noise IK handshake pattern:
 
Configuration (pre-shared out-of-band):
  • Each peer has long-term X25519 key pair (static)
  • Each peer knows the other's static public key
 
Handshake (per-connection):
  1. Initiator generates ephemeral X25519 key pair
  2. Initiator computes:
     • DH1 = X25519(ephemeral_private, responder_static_public)
     • DH2 = X25519(initiator_static_private, responder_static_public)
  3. These feed into Noise's key derivation
  
  4. Responder generates ephemeral X25519 key pair
  5. Responder computes:
     • DH3 = X25519(responder_static_private, initiator_ephemeral_public)
     • DH4 = X25519(responder_ephemeral_private, initiator_ephemeral_public)
  
  6. Full session key derived from DH1 || DH2 || DH3 || DH4
 
Security Properties:
  • Forward secrecy: ephemeral keys provide PFS
  • Identity hiding: static keys encrypted under ephemeral DH
  • Key confirmation: both sides verify handshake
""")
 
tls13_ecdhe_overview()
wireguard_ecdh_overview()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

"""
Hybrid Key Exchange: ECDH + Post-Quantum
 
This conceptually demonstrates hybrid key exchange combining
classical ECDH with post-quantum key encapsulation.
"""
 
def hybrid_key_exchange_concept():
    """
    Hybrid key exchange provides 'best of both worlds' security.
    
    The shared secret is derived from BOTH:
    1. Classical ECDH (proven, efficient, resistant to classical computers)
    2. Post-quantum KEM (believed resistant to quantum computers)
    
    If either algorithm is secure, the combined key is secure.
    """
    print("HYBRID KEY EXCHANGE (ECDH + ML-KEM)")
    print("=" * 65)
    
    print("""
    ┌─────────┐                                           ┌─────────┐
    │ Client  │                                           │ Server  │
    └────┬────┘                                           └────┬────┘
         │                                                     │
         │ Generate X25519 ephemeral key pair:                 │
         │   x25519_private, x25519_public                     │
         │                                                     │
         │ Generate ML-KEM key pair:                           │
         │   mlkem_private, mlkem_public                       │
         │                                                     │
         │ ClientHello:                                        │
         │   key_share: x25519_public || mlkem_public          │
         │ ──────────────────────────────────────────────────► │
         │                                                     │
         │                Generate X25519 ephemeral key pair   │
         │                Compute x25519_shared_secret         │
         │                                                     │
         │                Encapsulate to mlkem_public:         │
         │                   mlkem_ciphertext, mlkem_secret    │
         │                                                     │
         │                                    ServerHello:     │
         │                   key_share: x25519_public          │
         │                   mlkem_ciphertext                  │
         │ ◄────────────────────────────────────────────────── │
         │                                                     │
         │ Compute x25519_shared_secret                        │
         │ Decapsulate mlkem_ciphertext → mlkem_secret         │
         │                                                     │
         │ Combined secret = HKDF(x25519_secret || mlkem_secret)
         │                                                     │
         ▼                                                     ▼
    
    COMBINED SHARED SECRET:
    ========================
    If X25519 is broken (quantum), ML-KEM protects the key.
    If ML-KEM is broken (cryptanalysis), X25519 protects the key.
    Attacker must break BOTH to recover the shared secret.
    """)
 
    print("\nKEY SIZES:")
    print(f"  X25519 public key:        32 bytes")
    print(f"  ML-KEM-768 public key:    ~1,184 bytes")
    print(f"  ML-KEM-768 ciphertext:    ~1,088 bytes")
    print(f"  Combined overhead:        ~2,300 extra bytes per handshake")
    
    print("\nCURRENT STATUS:")
    print("  • Chrome/Chromium: Experimenting with X25519Kyber768")
    print("  • IETF: Drafts for hybrid key exchange in TLS")
    print("  • Signal: Planning post-quantum upgrade (PQXDH)")
    print("  • Cloudflare: Deployed hybrid TLS experimentally")
    
    print("\n" + "=" * 65)
 
 
hybrid_key_exchange_concept()