4
$\begingroup$

If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and private keys into keys under some other ECC curve?

In other words let's say Alice and Bob have C25519 key pairs. Alice has her public and private key and Bob's public key, and Bob has Alice's public key and his public and private. Alice and Bob want to convert their keys into NIST P-256 keys (or some other NIST curve) and then execute ECC key agreement using a FIPS compliant cryptographic module in order to run in a FIPS compliant mode of operation.

Is this possible? Is it secure?

Improve this question
$\endgroup$
1
  • $\begingroup$ Basically this is a hack to allow a C25519-based cryptosystem to operate in FIPS mode using a FIPS certified library. It would only work with other FIPS-mode endpoints of course. $\endgroup$
    – Adam Ierymenko
    Commented Jul 19, 2017 at 20:19

2 Answers 2

Reset to default
2
$\begingroup$

You could use the private Curve25519 key as the seed to a Key derivation function that allows arbitrary output lengths, such as HKDF. Use this HKDF output as the CSPRNG you would normally use to generate a NIST keypair. This should be deterministic so long as your library does not access the system RNG on its own when generating keys.

You should probably use a customization string such as 'FIPS P256 Key derivation for my_app_name' as an additional input or salt to the key derivation function to prevent any collisions if someone else has the same idea.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Yes, that can be done, and can be useful if short on entropy. But that way of generating the new NIST key pair won't solve the issue that the other party has no trust in the newly generated public key. $\endgroup$
    – fgrieu ♦
    Commented Jul 25, 2017 at 6:33
  • 1
    $\begingroup$ @fgrieu They could of course certify these new keys using their Curve25519 keys just as in your answer. The point of this deterministic approach is that they don't need to store and manage a new keypair. $\endgroup$
    – rmalayter
    Commented Jul 25, 2017 at 8:15
  • $\begingroup$ It would also make the upgrade deterministic, which is good in some contexts. $\endgroup$
    – Adam Ierymenko
    Commented Aug 21, 2017 at 14:39
9
$\begingroup$

No, conversion of an EC key pair from a curve to another of unrelated order is not possible.

One of the closest things that could be done would be that parties generate a new P256 key pair, then

  • certify their new P256 public key using their C25519 private key, check the other party's certificate using the other party's trusted C25519 public key, and now trust the other party's P256 public key.
  • or negotiate trusted symmetric session key(s) per their C25519 key pairs, and transmit their new P256 public key over a channel secured by symmetric crypto.
Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.