I found the following text when looking up KDFs:

In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter.

where a quick lookup suggests that DHES and DHAES are simply earlier names for ECIES.

What would be the reason to include the sender's public key into the KDF as a parameter? Other ECDH based schemes do not seem to do this.

If the sender's public key is altered then the calculated shared secret $Z$ would be invalid and the KDF would fail to generate the correct key anyway. Is this just an additional spurious security measure or am I missing some significant reasoning?

  • $\begingroup$ Can you put the link of the source? $\endgroup$ – kelalaka Feb 14 '19 at 9:32
  • $\begingroup$ @kelalaka Adjusted. $\endgroup$ – Maarten Bodewes Feb 14 '19 at 14:42
  • $\begingroup$ I suspect that the answer is in this or its references. But where? $\endgroup$ – fgrieu Feb 14 '19 at 15:49
  • $\begingroup$ I don't think so. I went through it entirely and found a statement that it doesn't use any parameters. That's not so strange as it defines the KDF1-4 without parameters as well. Can't speak of the references yet of course - as there are 25 I presume it is in there though - if not it will be in the references of the references :P. $\endgroup$ – Maarten Bodewes Feb 14 '19 at 16:16
  • $\begingroup$ I did a lot of looking into the references, but if it is there it has still escaped me. $\endgroup$ – Maarten Bodewes Apr 10 '19 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.