I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation function, which deterministically allows both sides to generate the same key given their partner's P-256 public key and a tweak value. The construction must have the property that computing the key for a new tweak value requires an operation on the hardware token, even if token outputs for many other tweak values are known.
I've come up with the following pseudocode:
// NIST recommended way to generate a private key l = 2^256 − 432420386565659656852420866394968145599 P256Priv(ikm): (HKDF_expand(40, ikm) % (l - 1)) + 1 // point multiplication with g as the P-256 generator P256Pub(p): g * p // different function instances for different tokens tokenECDH(inPub): ECDH(tokenPriv, inPub) // Using XOR because it makes both sides symmetrical TweakableKDF(tokenECDH, peerPub, tweak, numBytes): Epriv = P256Priv(tweak) Epub = P256Pub(Epriv) HKDF_expand(numBytes, tokenECDH(Epub) ^ ECDH(Epriv, peerPub))
It looks to me like this would be secure, but I don't want to be a Dave. (Also, I can't help but wonder if there's something standard out there that does this already; I looked briefly and was surprised I didn't find much.)
Any Questions? Comments? Snide remarks?