4
$\begingroup$

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private keys were generated randomly, it is infeasible to find $d_1$ from $Q_1$ (or $d_2$ from $Q_2$).

Now, say we know $d_1=d_2$. That is, we do not know the private key (it was generated randomly) but we do know it is the same for both public keys.

Does this situation compromises the security of the ECC key pairs? i.e.
Is it now possible (or even easier than before) to find the (shared) private key?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ Why would you want to do that? I can't think of any situation where this is useful. $\endgroup$
    – CodesInChaos
    Commented Mar 30, 2014 at 14:15
  • $\begingroup$ First, I believe it to be an interesting theoretical question. Second, I have an application that allows one to generate key pairs (over different curves), store the private key in some secured storage and also to derive a public key from a stored private key. Therefore, a user can (in principle) generate a key pair for one curve and then use the same private key to derive a public key for another curve. I want to understand if allowing such an API could compromise the security. $\endgroup$
    – user12778
    Commented Mar 30, 2014 at 14:25
  • 1
    $\begingroup$ For such an application any sane cryptographer would store a master-key and derive the individual keys with some kind of hash (I recommend HKDF-Expand). $\endgroup$
    – CodesInChaos
    Commented Mar 30, 2014 at 14:34
  • $\begingroup$ @CodesInChaos : $\:$ Only insofar as a PRF qualifies as "some kind of hash". $\;\;\;\;$ $\endgroup$
    – user991
    Commented Mar 30, 2014 at 14:40
  • $\begingroup$ I'm not posting this as an answer because I'm not 100% sure. Imho, I cannot see a thread situation because the hard problem that secures one key is different than the other. Suppose two isogeny curves (same $p$ different $a$ and $b$) they have the same cardinal but one $d$ on each one doesn't show any relation to break those two ECDLPs. $\endgroup$
    – srgblnch
    Commented Mar 30, 2014 at 17:46

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.