Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the hash size and the EC size. In other words, why isn't SHA512 used instead to provide bigger entropy?
I'm not too familiar with the actual ECDSA algorithm so I'm probably missing something.
Thanks!
First to explain you, why you get 512-bit outputs from a 256-bit curve:
The output is basically a point (x-coordinate is enough) and a message-dependant value, with the x-coordinate being expressed as integer. You can verify the signature by checking for a specific relationship between the point and the message-dependant value and the public key point. In order for this relationship to be build the private key is required.
Second, to answer your question why SHA-256 is used and not SHA-512. Consider how the hash function is actually used in ECDSA. You always take the $n$ leftmost bits of it, with $n$ being the curve order bitlength. So if you use SHA-512 you're "wasting" 256 bits, whereas with SHA-256 you "waste" nothing.
And from a key-length point it also makes sense to settle on the 128-bit security level (which is defined through your choice of secp256) and it would make no sense to choose a hash-function with 256-bit security level to be used with a curve providing 128-bits.
