Re: [Cfrg] uniform random distribution in ECDH public key

["David McGrew (mcgrew)" <[e-mail]>]

Hi Bob,

On 8/14/12 2:01 PM, "Robert Moskowitz" <[e-mail]> wrote:

>I understand from RFC 6090 and 5869 that the secret key produced from an
>ECDH exchange is not uniformly randomly distributed and that is why we
>have the 'Extract' phase in HKDF.  Got that.
>
>This question is about the public key, g^j:
>
>I understand that like j, it must be a point on the curve, thus if the
>curve is p-256, both j and g^j are 256 bits long.  But is g^j uniformly
>randomly distributed like j is suppose to be?

Something quick to add to what Scott said.   Note that j is uniformly
random when considered as an integer between 1 and the group order; it is
not uniformly random when considered as a bit string.

David

>
>Side question:  I am still unclear on the length of the exchanged secret
>(g^j)^k, is it 256 bits (for p-256) or larger (perhaps 512 bits)?
>
>Thank you for helping me get all this straight.
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg