Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Different keys.

For example, you might currently be using a public/private keypair for 4096-bit RSA. That keypair (by definition) only works for the RSA key exchange algorithm. Likewise, an x22519 keypair is for the x25519 key exchange.

A sntrup761x25519 keypair will be its own thing. As an aside, a sntrup761x25519 public key will be two public keys glued together (one for each algorithm). [1] Likewise for the private key.

(one could reuse an existing x25519 keypair for the x25519 component of sntrup761x25519, but it seems like a bad idea)

[1] https://github.com/openssh/openssh-portable/blob/master/kexs...



Same keys, servers and clients will keep using their ed25519 keys for authenticating each other, the keys for the key exchange are negotiated on login.


Huh! Thanks for the correction.

That makes a lot of sense -- I have some more reading to do...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: