2
$\begingroup$

In key agreement (or key exchange) protocols, is used signature for authentication. Suppose that key exchange protocols execute on elliptic curve. The initiator of protocol must sends signature of his message with main message. What happen if the curve used in key agreement protocol also used in signature inside of protocol?

For example in Diffie-Hellman key exchange over curve, Alice sends $aP$ and $sig_{k_a}(aP)$ to Bob that $P$ is the generator of curve $E$. The signature is the ECDSA (or EdDSA) on curve $E'$. Is $E=E'$? Is $E$ and $E'$ different? What kind of these situation are the best? what is the advantages?

$\endgroup$
0
1
$\begingroup$

In signature as practiced with ECC, the first step in $\operatorname{sig}_{k_a}(aP)$ is hashing $aP$. That seems to prevent any attack that would use $aP$ is computed on the curve used for signature, except if that reused the same hash on a secret curve point, which is not the case in ECDH as practiced (specific KDFs are used; and it would be possible to reuse the same hash with a different message formatting, e.g. a prefix).

Thus I see no more problem with using the same curve for key agreement and signature, than there is using the same curve for multiple public keys in signature. The later is common and has little drawback. It does allow to put in common some pre-computation effort, e.g. when attacking public keys with baby-step/giant-step, but this has negligible practical importance.

$\endgroup$
2
  • $\begingroup$ Thanks for your answer. What is your means from the 'later is common'? Is your means the case that use the same curve or different? Furthermore, I know the first step is hashing. My question is about the rest of the signing process. It means that, can we use the same generator point $P$ and the same curve $E$ for signature of $H(aP)$ as message?? $\endgroup$ Jun 15 at 11:22
  • 1
    $\begingroup$ @mehdi mahdavi oliaiy : My "the later is common" means that "using the same curve for multiple public keys in signature" "is common". It's fine. In my opinion, "using the same curve for key agreement and signature" is just as fine (subject to the common condition explained). $\endgroup$
    – fgrieu
    Jun 15 at 12:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.