Re: [Cfrg] uniform random distribution in ECDH public key

[Vadym Fedyukovych <[e-mail]>]

On Tue, Aug 14, 2012 at 02:01:46PM -0400, Robert Moskowitz wrote:
> I understand from RFC 6090 and 5869 that the secret key produced
> from an ECDH exchange is not uniformly randomly distributed and that
> is why we have the 'Extract' phase in HKDF.  Got that.

I'd say, shared secret produced by ECDH is "fixed" for two parties,
represented by their public keys.
HKDF (5869) would produce "per-application" keys then

> This question is about the public key, g^j:
> 
> I understand that like j, it must be a point on the curve, thus if
> the curve is p-256, both j and g^j are 256 bits long.  But is g^j
> uniformly randomly distributed like j is suppose to be?

g^j (or, in additive notation, jG) is distributed uniformly over non-trivial elements of the group,
on condition at least one of j or k (at section 4 of 6090) was chosen uniformly at random from integers 1 up to (group order -1).

"j" is not a point on the curve, but an index (logarithm) in the finite group

> Side question:  I am still unclear on the length of the exchanged
> secret (g^j)^k, is it 256 bits (for p-256) or larger (perhaps 512
> bits)?

Depends on representation of the point on the curve.
Basically, two numbers (x- and y- coordinates) of 256 bits long.

> Thank you for helping me get all this straight.