From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $h$ is $1$, Both should give the same result. So for curves such as secp256r1 (which has $h=1$) both should give the same result. Unfortunately, when I am coding it using some third party libraries for Diffie-Hellman primitive without cofactor, I am not getting the expected result of Diffie Hellman with the cofactor. At this point, I am not sure if I have understood the theory incorrectly or if there's some issue with my code. Could someone verify or refute my understanding?
$\begingroup$
$\endgroup$
6
-
$\begingroup$ You say "both should give the same result". Both what? Do you mean that you're getting $(g^a)^b \ne (g^b)^a$? Then it's a bug in your code. Nothing to do with the cofactor. $\endgroup$– fkraiemCommented Jun 18, 2019 at 8:19
-
$\begingroup$ @fkraiem . Actually, I meant that ( ECDH with cofactor) and (ECDH without cofactor) should both give the same result if the cofactor of the curve is 1 . After using another third party source I am getting the correct result. There seems to be an issue in code $\endgroup$– UchihaItachiCommented Jun 18, 2019 at 8:59
-
$\begingroup$ "ECDH with(out) cofactor" is not standard terminology. I personally have no idea what it could mean; ECDH is ECDH, regardless of the cofactor. $\endgroup$– fkraiemCommented Jun 18, 2019 at 10:29
-
$\begingroup$ I have come across the terms "Elliptic Curve Diffie-Hellman Primitive" and "Elliptic Curve Cofactor Diffie-Hellman Primitive" for differentiating them in a pretty standard documentation. secg.org/sec1-v2.pdf $\endgroup$– UchihaItachiCommented Jun 18, 2019 at 11:06
-
$\begingroup$ You should add this reference to your question. Of course, if the cofactor is 1, the two procedures are the same. $\endgroup$– fkraiemCommented Jun 18, 2019 at 11:17
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
1
Just to close this question . Yes, both ( ECDH with cofactor) and (ECDH without cofactor) give the same result if the cofactor of the curve is 1. After using another third party source I am getting the correct result. There was an issue in the code
-
$\begingroup$ A cofactor of 1 results in the identity function for both multiplication and exponentiation, so obviously this is correct. $\endgroup$– Maarten Bodewes ♦Commented Jun 20, 2019 at 22:10