1
$\begingroup$

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1.

Can i achieve something like this in ECDH? where Bob can calculate the shared key without knowing the private key?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Similarly, just send the identity element $\mathcal{O}$ as the public key.

Alice must be a fool to not validate the public key to fall into this trap. The first rule is to check that $P \neq \mathcal{O}$

Update per user's comment

How can i find the identity element of curve 25519?

The identity of some curves like Curve25519 is the point of infinity ( represented as $\mathcal{O} \text { or } \infty$) and this can't be represented in the affine coordinates. We need to use projective coordinate systems.

We took the Curve25519 equation $$y^2 = x^3 + 486662 x^2 + x$$ and convert it into homogeneous equation $$Y^2 Z - X^3 - 486662 X^2 Z - X Z^2$$

Now the points are triple $(X:Y:Z)$ where actually a point now represent a line $(\lambda X:\lambda Y: \lambda Z)$

The point at infinity is $(0:1:0)$ and this cannot be treated as an affine point.

Any affine point $(x,y)$ can be turned into homogenous by $(x:y:1)$ and any homogenous point other than the infinity $(X:Y:Z)$ can be turned back with $(X/Z,Y/Z)$.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Another potential defense is simply not have a 'bits-on-the-wire' representation that you interpret as $\mathcal{O}$; hence you cannot possibly receive it... $\endgroup$
    – poncho
    Commented Apr 12, 2021 at 21:08
  • $\begingroup$ @poncho any library does this? $\endgroup$
    – kelalaka
    Commented Apr 12, 2021 at 21:12
  • $\begingroup$ Well, if you're conforming to a spec that specifies formats (such as TLS or IKE), and they don't specify how you would transmit $\mathcal{O}$ (which TLS/IKE doesn't for P256), hence they'd have to do it. $\endgroup$
    – poncho
    Commented Apr 12, 2021 at 21:26
  • $\begingroup$ @kelalaka How can i find the identity element of curve 25519? $\endgroup$
    – Ashraf Yassin
    Commented Apr 15, 2021 at 17:39
  • $\begingroup$ @AshrafYassin updated the asnwer. $\endgroup$
    – kelalaka
    Commented Apr 15, 2021 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.