1
$\begingroup$

I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, 521, 192 and 256 ($h=1$) as well as K-163, 233, and 283, and B-409 and 571 ($h \ne 1$). Being new to crypto in general I did some research and found that there are test vectors by known agencies like NIST, SECG, and IETF (I think), that I can use for verifying the system is implemented correctly. But for ECDH specifically, I could find test vectors only for the $h=1$ curves. However, I found NIST ECC CDH test vectors for all of the curves. So I had to read up on ECC CDH versus ECDH. This website helped the most in that regard.

My question is: can I use the test vectors intended for ECC CDH to test the $h \ne 1$ curves on my ECDH system simply by premultiplying the private key from the test vector by the known cofactor of the curve and expecting the right result to come out? Perhaps if the key overflows the expected number of bits, maybe not, in which case I can simply rule out that test vector from the test?

(Now if it's dodgy to use regular ECDH with $h>1$ curves, just remember: I didn't write the requirements!)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.