1
$\begingroup$

I'm trying to understand Diffie–Hellman based on Elliptic-curves. Can one explain at which point of time the domain parameters are shared? Are they shared trough a public channel and can they be always the same? Are they shared at a specific different point of time?

Literature doesn't clearly answer my question...

I'd like to create a concept to establish a secure communication channel between two devices that "don't know each other but want to establish a secure channel"

Improve this question
$\endgroup$
4
  • $\begingroup$ Are you talking about TLS? $\endgroup$
    – kelalaka
    Dec 10, 2020 at 19:42
  • $\begingroup$ Actually not, talking only about elliptic curve diffie hellmann.. $\endgroup$
    – MaMa
    Dec 10, 2020 at 19:44
  • 2
    $\begingroup$ "I'd like to create a concept to establish a secure communication channel between two devices that "don't know each other but want to establish a secure channel"" - actually, fundamental to security is authentication; how do you know the party you share keys with is the party you intend? You need to think how to solve this as well. $\endgroup$
    – poncho
    Dec 10, 2020 at 19:50
  • $\begingroup$ Well, i could use signatures, sign my data and share it. When using the normal diffie hellmann i could Carsten A,p,q sign thud data and send it to B. Based on the signature he could verify the data.. but instead i could also use the public key of the receiver to directly send a symmetric key $\endgroup$
    – MaMa
    Dec 10, 2020 at 20:12

1 Answer 1

Reset to default
1
$\begingroup$

How the parameter set to use is established depends on the (application) protocol entirely. They need to be established before the key agreement operation takes place, but there aren't really any other requirements. Usually they are shared by name or OID (short for Object Identifier usually encoded using Abstract Syntax Notation One or ASN.1) in the protocol, but it is also possible to just allow a single curve for a specific (version of) a protocol. Quite often the domain parameters are simply listed and given an index number in a protocol as well, if just to save space.

Sometimes the entire set of parameter values are simply send over (which is what I would call "sharing"). This is for instance the case for some smart card based protocols as it is a bit unwieldy to store all the curves in the limited storage available. In general you want to trust the party that sends over the parameters though. If some curves or sizes are optional then you may need to come to some kind of agreement between the parties about which curve to use, although I haven't seen many flexible protocols like that. Sharing parameters isn't all that common, usually well known curves are used so there is no need to share the parameter sets.

When it comes to card verifiable certificates in ePassports, the root certificate defines which domain parameters are to be used. The underlying keys (it contains 3 levels) will always use the same curve as the root. And staying with ePassports, there is also a scheme called PACE where the new domain parameters are calculated from a previous set (the sets only differ w.r.t. base point G of course, not the entire set).

Improve this answer
$\endgroup$
1
  • $\begingroup$ Ok, I read some papers and watched a couple of videos. I figured out that the domain parameters are shared beforehand (as you mentioned) and they are standardized in some cases. Therefore, If a very specific system is configured to work only with a specific set of domain parameters, nothing else than the public keys are shared to establish a common secret. $\endgroup$
    – MaMa
    Dec 11, 2020 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.