Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private keys were generated randomly, it is infeasible to find $d_1$ from $Q_1$ (or $d_2$ from $Q_2$).

Now, say we know $d_1=d_2$. That is, we do not know the private key (it was generated randomly) but we do know it is the same for both public keys.

Does this situation compromises the security of the ECC key pairs? i.e.
Is it now possible (or even easier than before) to find the (shared) private key?

  • 1
    $\begingroup$ Why would you want to do that? I can't think of any situation where this is useful. $\endgroup$ – CodesInChaos Mar 30 '14 at 14:15
  • $\begingroup$ First, I believe it to be an interesting theoretical question. Second, I have an application that allows one to generate key pairs (over different curves), store the private key in some secured storage and also to derive a public key from a stored private key. Therefore, a user can (in principle) generate a key pair for one curve and then use the same private key to derive a public key for another curve. I want to understand if allowing such an API could compromise the security. $\endgroup$ – user12778 Mar 30 '14 at 14:25
  • 1
    $\begingroup$ For such an application any sane cryptographer would store a master-key and derive the individual keys with some kind of hash (I recommend HKDF-Expand). $\endgroup$ – CodesInChaos Mar 30 '14 at 14:34
  • $\begingroup$ @CodesInChaos : $\:$ Only insofar as a PRF qualifies as "some kind of hash". $\;\;\;\;$ $\endgroup$ – user991 Mar 30 '14 at 14:40
  • $\begingroup$ I'm not posting this as an answer because I'm not 100% sure. Imho, I cannot see a thread situation because the hard problem that secures one key is different than the other. Suppose two isogeny curves (same $p$ different $a$ and $b$) they have the same cardinal but one $d$ on each one doesn't show any relation to break those two ECDLPs. $\endgroup$ – srgblnch Mar 30 '14 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.