In Cryptographic Algorithm Validation Program for KDF document, here, page 9, it says "If a field size that is not a multiple of 8 bits, the shared secret is represented by a string of bytes that is padded with zeros on the left".

However, I get a valid input like this, dhLength=4348 g^xy=ED6DAAE... (Total contains 1088 characters in hex, so 544 bytes, so 4352 bits)

where dhLength < length of g^xy, how to handle this situation, also g^xy is not started with padding 0. I tried to cut, pad 0 to extra long, erase 'E' to '0', results are all wrong.

  • $\begingroup$ That is completely a programming issue and going to be off-topic here. With a nicely presented code, it can be answered in StackOverflow. Do you keep this data in which form? BYTE []? $\endgroup$ – kelalaka Jun 21 at 20:23
  • $\begingroup$ Hi, @kelalaka . My question could be if dhLength(in bits) < g^xy length(in bits), what shall I do? CAVP standards only talk about dhLength > g^xy length, and the provided request vectors also dhLength > g^xy. For programming, I firstly read the hex, convert to bytes, then input bytes array and size in bytes. In this case, (g_xy_byte, 544) are input. My software itself 100% no problem. $\endgroup$ – Joe Jun 21 at 20:33
  • $\begingroup$ I think there is something seriously wrong if you get values that are larger than the field size, right? $\endgroup$ – Maarten Bodewes Jun 21 at 20:34
  • $\begingroup$ @MaartenBodewes True. But this is the valid vector that provides from NIST ACVP ( Automated Cryptographic Validation Program). I am also confused with it. $\endgroup$ – Joe Jun 21 at 20:36
  • $\begingroup$ dhLength(in bits) < g^xy length(in bits) this shouldn't be the case since $g^{xy}$ is computed modulo. $\endgroup$ – kelalaka Jun 21 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.