I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM.

But when I test with SoftHSM via PKCS#11 library, the ECDH function returns a symmetric key directly even with KDF parameter set to null. I did some research and found that some bytes of the shared secret is returned as the value of the symmetric key: https://github.com/google/boringssl/blob/master/include/openssl/ecdh.h#L82

However, I am confused how such operation can be performed on the shared secret if it is represented in the form of a EC point (x, y).

Does anyone know how SoftHSM handles ECDH with KDF parameter as null? Especially, what form is the shared secret in after being generated in SoftHSM but before being processed and put in a key object?


  • $\begingroup$ Usually the X, Y coordinates are encoded as unsigned, statically sized, big integer values and then concatenated. The bytes are then taken from the left hand side. If I had to guess that would be what a library does, but to be sure you'd have to look into the source code or test it with another library / key pair. $\endgroup$
    – Maarten Bodewes
    May 20 at 23:19
  • $\begingroup$ Many ECDH implementations only compute one coordinate of the shared secret. $\endgroup$ May 21 at 11:59
  • $\begingroup$ github.com/opendnssec/SoftHSMv2 $\endgroup$
    – kelalaka
    May 21 at 15:17
  • $\begingroup$ @CodesInChaos Hey, glad you are still here! Yes, I wondered if I should have mentioned that that's another option, that only the X coordinate is used. But hey, when coming from the left hand side it hopefully doesn't make a big difference (it could of course one side uses just X for key derivation and the other X and Y). $\endgroup$
    – Maarten Bodewes
    May 21 at 16:54
  • $\begingroup$ Thanks @MaartenBodewes for the reply. I did look into the code of SoftHSM and it is kinda doing what you said, taking certain length from the generated secret. But I am confused how the generated secret gets transformed from an EC point to bytes. Are x and y transformed to bytes and concatenated or there is a specific method? For example, ECPublicKey is formed like tag + x + y. Thanks! $\endgroup$
    – Fan Zhang
    May 23 at 18:32


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy