If one navigates to the ECDSA Go package page, he can observe that:

This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash))

While I am familiar with AES in CTR mode and SHA2-512, I am not familiar with what ChopMD refers to and I haven't been able to find any definite answer.

The only reference to ChopMD I have found is this PDF, showcasing how to improve ChopMD but never really going into detail as to who conceived it, why etc. MD commonly stands for Message Digest in the hashing functions but within the paper, MD refers to the Merkle-Damgaard construct, which is internally used by MD-5, SHA-2 and SHA-1.

If someone could clear up what ChopMD refers to I would appreciate it.

  • $\begingroup$ I edited in the actual paper PDF instead of just the citation link. In the future you may want to check yourself whether the paper you are looking for is available via the IACR which is usually the case for papers that are a few years old. $\endgroup$
    – SEJPM
    Jul 9 '18 at 12:32

Let $n$ be the digest length of a hash function $\operatorname{MD}^f:\{0,1\}^*\to\{0,1\}^n$. Now quoting the paper you linked:

chopMD. For $0\leq s<n$ we define $\operatorname{chop}_s(x)=x_R$ where $x=x_L\parallel x_R$ and $\left|x_L\right|=s$. In this paper we fix $0<s<n$ and define $\operatorname{chopMD}^f(M)=\operatorname{chop}_s(\operatorname{MD}^f(M))$.

So the idea is basically "take the value, run it through the specified hash function and discard ("chop off") the first $s$ bits", which is a pretty intuitive and standard ways to get a small-domain hash function from a large-domain hash function.

So TL;DR: It appears the package runs the given data fields through SHA-512 and then only returns the last 256 bit of the resulting hash.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.