# Tag Info

5

I would appreciate an example showing how to find such a curve $E'$ and a point $R$ for some "popular" $E$ (e.g. one of the NIST curves). I won't actually work out the example (it's a bit more work than I feel like doing at the moment), however I will walk you through the steps: Pick a random $b'$ value, and so we have the curve $E' : y^2 = x^3 + ax + b'$ ...

4

This has been (re-)defined in RFC 3279: "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". For DH section 2.3.3: "Diffie-Hellman Key Exchange Keys" applies: Here is the ASN.1 module (which was copied from X9.42, so this is at least a copy of a copy): DomainParameters ::=...

4

Are there any other issues, besides the randomness of the 256-bit private key to consider? Not really. The DLog problem really doesn't have any 'weak keys', that is, keys that can be broken with less effort than other keys. Now, you might say "hey, isn't the key '1' easier to break than others?" Not really; you might consider '1' easy to break because $g^... 3 Is there an efficient algorithm for finding curves with small order points? Yup, just choose a curve at random and you will find one soon enough. Example with P-256 in Pari/GP. First create the curve and check that its order matches the expected one just to be sure: (00:31) gp > p = ... 2 A group if a set of elements and some operation that satisfy some requirements. This operation is usually called "addition" or "multiplication", depending on the group, even though it may not be actually the classic addition or multiplication. The integers$0 < x < p$for some prime$p$form a group under the modular multiplication operation (multiply ... 2 How is the 3072-bit modulus derived? Find the smallest$c$such that $$p = 2^n - 2^{n - 64} - 1 + 2^{64} (\lfloor 2^{n - 130} \pi\rfloor + c)$$ and$q = (p - 1)/2$are prime, and$p \equiv 7 \pmod 8$. In this case,$n = 3072$and so$c = 1690314$. Use$g = 2$as the generator. (Here$\pi = \int_{-1}^1 dx/\sqrt{1 - x^2} = 4/[1 + \mathrm K_{i=1}^\infty i^2/...

1

Just to close this question . Yes, both ( ECDH with cofactor) and (ECDH without cofactor) give the same result if the cofactor of the curve is 1. After using another third party source I am getting the correct result. There was an issue in the code

1

Diffie-Hellman gives you a shared secret. Something like CBC + HMAC needs a key for the block cipher and a key for the MAC. CTR + HMAC would need a key for the block cipher and a key for the MAC. An AEAD needs a key. These parameters are usually needed twice: one set for transmit (tx) and one set for receive (rx), or client to server and server to client. ...

1

1 - Is it mathematically possible to generate a shared secret starting with 0x0n using ECDH? (My guess is "yes") Yes; the shared secret is the $x$ coordinate; approximately half of the values between 0 and $p-1$ (where $p$ is the prime that the elliptic curve is defined over) are possible; there's no reason to believe that the values with a top nybble of 0 ...

Only top voted, non community-wiki answers of a minimum length are eligible