如何使用Nettle的Curve25519函数实现密钥交换以构建加密TCP连接？

Great question! Since you're focused on learning by implementing from scratch with Nettle (which is a fantastic choice for low-level crypto work), let's walk through exactly how to implement Curve25519 key exchange step by step, tailored to your TCP encryption project.

Nettle provides two straightforward functions for Curve25519 key exchange—these are all you need for the core handshake:

• curve25519_generate_public_key(uint8_t *pub, const uint8_t *priv): Takes a 32-byte private key and outputs the corresponding 32-byte public key.
• curve25519_shared_secret(uint8_t *shared, const uint8_t *priv, const uint8_t *pub): Computes the 32-byte shared secret using your private key and the peer's public key. Both sides will end up with identical shared secrets.

First, make sure you include the necessary header:

#include <nettle/curve25519.h>

Both your client and server need to generate their own key pairs. The critical part here is using a cryptographically secure random number generator (CSPRNG) for the private key—never use rand()! Nettle's Yarrow256 is a great option for this.

Here's a code snippet to generate a key pair:

#include <nettle/yarrow256.h>
#include <nettle/random.h>

// Initialize and seed the CSPRNG (do this once at startup)
struct yarrow256_ctx random_ctx;
uint8_t seed[32]; // Grab this from /dev/urandom or another high-entropy source

// Seed the random generator (replace with actual seed collection logic)
FILE *urandom = fopen("/dev/urandom", "r");
fread(seed, sizeof(seed), 1, urandom);
fclose(urandom);

yarrow256_init(&random_ctx);
yarrow256_seed(&random_ctx, sizeof(seed), seed);

// Generate private key (32 bytes)
uint8_t private_key[CURVE25519_KEY_SIZE];
nettle_get_random(&random_ctx, CURVE25519_KEY_SIZE, private_key);

// Apply Curve25519's private key constraints (Nettle might do this automatically, but it's safe to enforce)
private_key[0] &= 0xF8;  // Clear bottom 3 bits
private_key[31] &= 0x7F; // Clear top bit
private_key[31] |= 0x40; // Set second-top bit

// Generate corresponding public key
uint8_t public_key[CURVE25519_KEY_SIZE];
curve25519_generate_public_key(public_key, private_key);

Once your TCP connection is established, each side needs to send their 32-byte public key to the other. You can send this as raw binary data (most efficient) or encode it as hex/base64 (easier for debugging).

For example, on the client:

// Send public key to server
send(sockfd, public_key, CURVE25519_KEY_SIZE, 0);
// Receive server's public key
uint8_t server_pub[CURVE25519_KEY_SIZE];
recv(sockfd, server_pub, CURVE25519_KEY_SIZE, 0);

And the server does the reverse: receive the client's public key first, then send its own.

Now both sides can compute the shared secret using their own private key and the peer's public key:

Client side:

uint8_t shared_secret[CURVE25519_KEY_SIZE];
curve25519_shared_secret(shared_secret, client_private_key, server_pub);

Server side:

uint8_t shared_secret[CURVE25519_KEY_SIZE];
curve25519_shared_secret(shared_secret, server_private_key, client_pub);

At this point, shared_secret will be identical on both client and server.

The raw Curve25519 shared secret shouldn't be used directly for encryption—you need to pass it through a Key Derivation Function (KDF) to generate keys tailored to your encryption algorithm (like AES-GCM). Nettle includes HKDF (HMAC-based Extract-and-Expand Key Derivation Function) which is perfect for this.

Here's how to derive an AES-128 key and IV using HKDF-SHA256:

#include <nettle/hkdf.h>
#include <nettle/sha2.h>

uint8_t aes_key[16];    // AES-128 key
uint8_t aes_iv[12];     // IV for AES-GCM (12 bytes is recommended)
uint8_t salt[16];       // Random salt (exchange this with the peer during handshake)
uint8_t info[] = "tcp-encryption-v1"; // Contextual info to avoid key reuse across scenarios

// Generate and send salt to peer (do this before deriving keys)
nettle_get_random(&random_ctx, sizeof(salt), salt);
send(sockfd, salt, sizeof(salt), 0);
recv(sockfd, salt, sizeof(salt), 0); // Server would receive the client's salt here

// Derive AES key
hkdf_sha256(aes_key, sizeof(aes_key), salt, sizeof(salt), shared_secret, sizeof(shared_secret), info, sizeof(info)-1);

// Derive IV (you can use HKDF again with different info, or generate a new random IV per message)
hkdf_sha256(aes_iv, sizeof(aes_iv), salt, sizeof(salt), shared_secret, sizeof(shared_secret), "tcp-encryption-iv", strlen("tcp-encryption-iv"));

• Prevent Man-in-the-Middle Attacks: Since you mentioned public key authentication, you should sign the Curve25519 public key with a pre-shared RSA key (like the one you already implemented). For example, the client signs its Curve25519 pubkey with its RSA private key, sends the signature along with the pubkey, and the server verifies it using the client's pre-shared RSA pubkey.
• Use Authenticated Encryption: For actual data transmission, use an AEAD (Authenticated Encryption with Associated Data) mode like AES-GCM. Nettle has full support for this via nettle_aes_gcm_* functions.
• Key Rotation: Consider rotating Curve25519 keys periodically (e.g., per session) to limit exposure if a key is compromised.

内容的提问来源于stack exchange，提问作者JATothrim