Re: [Cfrg] uniform random distribution in ECDH public key

No, the value g^j (or jG, if we prefer the more traditional additive notation for elliptic curves) is not uniform; it is a 512 bit value (for P256), and corresponds to a point on the curve (that is, it is a pair of 256 bit values that together are a solution to a specific cubic equation).  There are approximately 2^256 possible values for this 512 bit value, and so there are a large number of 512 bit public values which are not possible.

-----Original Message-----
From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf Of Robert Moskowitz
Sent: Tuesday, August 14, 2012 2:02 PM
To: cfrg@irtf.org
Subject: [Cfrg] uniform random distribution in ECDH public key

I understand from RFC 6090 and 5869 that the secret key produced from an 
ECDH exchange is not uniformly randomly distributed and that is why we 
have the 'Extract' phase in HKDF.  Got that.

This question is about the public key, g^j:

I understand that like j, it must be a point on the curve, thus if the 
curve is p-256, both j and g^j are 256 bits long.  But is g^j uniformly 
randomly distributed like j is suppose to be?

Side question:  I am still unclear on the length of the exchanged secret 
(g^j)^k, is it 256 bits (for p-256) or larger (perhaps 512 bits)?

Thank you for helping me get all this straight.

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
http://www.irtf.org/mailman/listinfo/cfrg