DJB's nistp224
program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.
To the best of my understanding, ECDH relative to this curve should produce 225-bit public messages (compressed points consisting of a 224-bit x-coordinate and a 1-bit y-coordinate), which require 29 bytes to encode (in SEC1 format). Yet somehow nistp224
manages to produce 28-byte messages, which are therefore one bit short.
How does it do this? I find the source code utterly unenlightening.
(Rationale for question: It sure would be nice if I could shave a byte off my messages on the wire.)