Elligator

When do you need Elligator?

Elligator addresses a specific problem: you need to perform a cryptographic key exchange protocol, and hide the very fact that you are using cryptography. A cryptographic key exchange can happen in various forms. The most popular ones often use Diffie-Hellman key exchanges and send random public keys over the network. Problem is, random public keys are not random bytes.

Who is this website for?

We are a secondary resource aimed at implementers of cryptographic protocols that use Elligator. We assume some familiarity with terms commonly used in elliptic curve cryptography. If you need an introduction or a refresher, we recommend the excellent “ECCHacks” talk by Daniel J. Bernstein and Tanja Lange.

Is Elligator the solution to censorship-resistance?

It is part of the solution. Elligator can hide positive proof that a cryptographic key exchange is taking place. It goes without saying, however, that it is exceedingly unlikely for two hosts to just send each other random data; the mere presence of sequences of random bytes in and of itself remains suspicious.

What other applications does Elligator have?

Elligator is not limited to plausible deniability and censorship-resistance. A number of cryptographic protocols need a way to map an arbitrary input to an elliptic curve point whose factorisation is unknown (“hashing to an elliptic curve”), such as verifiable random functions (VRFs) and oblivious pseudorandom functions (OPRFs).