Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private keys were generated randomly, it is infeasible to find $d_1$ from $Q_1$ (or $d_2$ from $Q_2$).

Now, say we know $d_1=d_2$. That is, we do not know the private key (it was generated randomly) but we do know it is the same for both public keys.

Does this situation compromises the security of the ECC key pairs? i.e.
Is it now possible (or even easier than before) to find the (shared) private key?

share|improve this question
1  
Why would you want to do that? I can't think of any situation where this is useful. –  CodesInChaos Mar 30 at 14:15
    
First, I believe it to be an interesting theoretical question. Second, I have an application that allows one to generate key pairs (over different curves), store the private key in some secured storage and also to derive a public key from a stored private key. Therefore, a user can (in principle) generate a key pair for one curve and then use the same private key to derive a public key for another curve. I want to understand if allowing such an API could compromise the security. –  user12778 Mar 30 at 14:25
    
For such an application any sane cryptographer would store a master-key and derive the individual keys with some kind of hash (I recommend HKDF-Expand). –  CodesInChaos Mar 30 at 14:34
    
@CodesInChaos : $\:$ Only insofar as a PRF qualifies as "some kind of hash". $\;\;\;\;$ –  Ricky Demer Mar 30 at 14:40
    
I'm not posting this as an answer because I'm not 100% sure. Imho, I cannot see a thread situation because the hard problem that secures one key is different than the other. Suppose two isogeny curves (same $p$ different $a$ and $b$) they have the same cardinal but one $d$ on each one doesn't show any relation to break those two ECDLPs. –  srgblnch Mar 30 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.