I'm using secp256k1; in normal scenario alice.privateKey and bob.publicKey (or vice versa) is used to derive the same secret.

Is it safe to use alice.privateKey and alice.publicKey to derive secret as a key for encryption for alice's personal information - where alice.publicKey and encrypted blob is publicly available?


Yes, recovering the computed secret is as hard as doing it for conventional Diffie-Hellman and thus infeasible for any secure groups.

This is known as Square-Diffie-Hellman problem, the reduction to the computational Diffie-Hellman problem (CDH) can be found in this Q&A.

| improve this answer | |
  • $\begingroup$ It does however seem unwise. In addition to whatever cipher you use you now also introduce the additional attack surface of ECC. $\endgroup$ – user10653 Dec 1 '17 at 21:07
  • 1
    $\begingroup$ @dingrite Actually I can see the point of doing this. For example consider a smartcard / HSM with an ECDH engine (which would provide you with eg a CDH oracle) but without a symmetric keystore. You can then use this HW device to hardware-enforce your "symmetric" key(s). $\endgroup$ – SEJPM Dec 1 '17 at 21:31
  • $\begingroup$ Is it required to input a salt or something similar as used in static-static DH key agreement? It seems to me that you would otherwise always derive the same secret. $\endgroup$ – Maarten Bodewes Dec 2 '17 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.