My friend came up with the following idea: assuming we agreed on curve parameters, use the following algorithm for key stretching/derivation from user-entered password.
- Pad the ascii representation of the password to
nbits or use any simple hash function, e.g. MD5 to allow passwords of arbitrary length
- Compute the resulting key as a multiplication of the curve generator point by the number we got at step #1.
In other words, we consider the user-entered password to be the
private key of ECDSA and use the
public key derivation algorithm as a key stretching function.
Now this looks pretty simple and effective (my CPU only manages to do less than a couple thousand multiplications per second and it seems there is no way to get significant speedups using GPUs). Is this algorithm actually used anywhere? If not, what are some obvious flaws that I can point to for my friend and make fun of him?
EDIT: Thanks for answers! Can't upvote yet due to low rep. The idea was to use this method as a slow hash function for password hashing (as a replacement for bcrypt for example). IMPROVED VERSION: Assuming we use SHA256 in the first step to hash the entered password, then multiply with the generator point in the p256 curve and use the X coordinate of the resulting point as a 256-bit hash of the password. Is this hash good enough for this purpose?
This is a purely theoretical question of course, we are not going to actually use any homebrew cryptography in our app!