1
$\begingroup$

From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $h$ is $1$, Both should give the same result. So for curves such as secp256r1 (which has $h=1$) both should give the same result. Unfortunately, when I am coding it using some third party libraries for Diffie-Hellman primitive without cofactor, I am not getting the expected result of Diffie Hellman with the cofactor. At this point, I am not sure if I have understood the theory incorrectly or if there's some issue with my code. Could someone verify or refute my understanding?

$\endgroup$
  • $\begingroup$ You say "both should give the same result". Both what? Do you mean that you're getting $(g^a)^b \ne (g^b)^a$? Then it's a bug in your code. Nothing to do with the cofactor. $\endgroup$ – fkraiem Jun 18 at 8:19
  • $\begingroup$ @fkraiem . Actually, I meant that ( ECDH with cofactor) and (ECDH without cofactor) should both give the same result if the cofactor of the curve is 1 . After using another third party source I am getting the correct result. There seems to be an issue in code $\endgroup$ – UchihaItachi Jun 18 at 8:59
  • $\begingroup$ "ECDH with(out) cofactor" is not standard terminology. I personally have no idea what it could mean; ECDH is ECDH, regardless of the cofactor. $\endgroup$ – fkraiem Jun 18 at 10:29
  • $\begingroup$ I have come across the terms "Elliptic Curve Diffie-Hellman Primitive" and "Elliptic Curve Cofactor Diffie-Hellman Primitive" for differentiating them in a pretty standard documentation. secg.org/sec1-v2.pdf $\endgroup$ – UchihaItachi Jun 18 at 11:06
  • $\begingroup$ You should add this reference to your question. Of course, if the cofactor is 1, the two procedures are the same. $\endgroup$ – fkraiem Jun 18 at 11:17
1
$\begingroup$

Just to close this question . Yes, both ( ECDH with cofactor) and (ECDH without cofactor) give the same result if the cofactor of the curve is 1. After using another third party source I am getting the correct result. There was an issue in the code

$\endgroup$
  • $\begingroup$ A cofactor of 1 results in the identity function for both multiplication and exponentiation, so obviously this is correct. $\endgroup$ – Maarten Bodewes Jun 20 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.