3
$\begingroup$

I'm using secp256k1; in normal scenario alice.privateKey and bob.publicKey (or vice versa) is used to derive the same secret.

Is it safe to use alice.privateKey and alice.publicKey to derive secret as a key for encryption for alice's personal information - where alice.publicKey and encrypted blob is publicly available?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

Yes, recovering the computed secret is as hard as doing it for conventional Diffie-Hellman and thus infeasible for any secure groups.

This is known as Square-Diffie-Hellman problem, the reduction to the computational Diffie-Hellman problem (CDH) can be found in this Q&A.

Improve this answer
$\endgroup$
3
  • $\begingroup$ It does however seem unwise. In addition to whatever cipher you use you now also introduce the additional attack surface of ECC. $\endgroup$
    – user10653
    Commented Dec 1, 2017 at 21:07
  • 1
    $\begingroup$ @dingrite Actually I can see the point of doing this. For example consider a smartcard / HSM with an ECDH engine (which would provide you with eg a CDH oracle) but without a symmetric keystore. You can then use this HW device to hardware-enforce your "symmetric" key(s). $\endgroup$
    – SEJPM
    Commented Dec 1, 2017 at 21:31
  • $\begingroup$ Is it required to input a salt or something similar as used in static-static DH key agreement? It seems to me that you would otherwise always derive the same secret. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 2, 2017 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.