1
$\begingroup$

the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF.... if so, then what additional security is provided by the KDF???

i'm operating in a very resource-constrained embedded environment, where eliminating code normally used in a KDF (eg., SHA256) is critical... i should also add that ECDH private key is generated from a truly random 256-bit seed....

i'm already using 128-bit AES-CCM for encryption/authentication.... perhaps i can use the AES engine in some manner to "hash" the shared secret if that is advantageous....

that gives me three choices to produce a 128-bit AES key from my ECDH shared secret:

  1. use the secret's x-coordinate (trimming its size)
  2. applying a SHA-256 hash
  3. using AES-CCM for hashing (with some known key/IV)

what are the tradeoffs here and are there any other options worth considering???

Improve this question
$\endgroup$
1
  • $\begingroup$ In this case, using KDF can only slow down the key-search. One can use both. $\endgroup$
    – kelalaka
    May 18, 2020 at 21:35

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.