# Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs:

In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter.

where a quick lookup suggests that DHES and DHAES are simply earlier names for ECIES.

What would be the reason to include the sender's public key into the KDF as a parameter? Other ECDH based schemes do not seem to do this.

If the sender's public key is altered then the calculated shared secret $$Z$$ would be invalid and the KDF would fail to generate the correct key anyway. Is this just an additional spurious security measure or am I missing some significant reasoning?

• Can you put the link of the source? – kelalaka Feb 14 '19 at 9:32
• @kelalaka Adjusted. – Maarten Bodewes Feb 14 '19 at 14:42
• I suspect that the answer is in this or its references. But where? – fgrieu Feb 14 '19 at 15:49
• I don't think so. I went through it entirely and found a statement that it doesn't use any parameters. That's not so strange as it defines the KDF1-4 without parameters as well. Can't speak of the references yet of course - as there are 25 I presume it is in there though - if not it will be in the references of the references :P. – Maarten Bodewes Feb 14 '19 at 16:16
• I did a lot of looking into the references, but if it is there it has still escaped me. – Maarten Bodewes Apr 10 '19 at 22:35