Re: [Cfrg] uniform random distribution in ECDH public key

[David Jacobson <[e-mail]>]

On 08/24/2012 01:07 PM, Dan Brown wrote:

[ giant SNIP of everything]

Thank you for answering my question about the need for hashing.

I'll summarize the takeaway for me with the following points, with some 
extra stuff by me, that I hope is correct.

1.  It is easy to test whether there exists a Y such that (key,Y) is on 
the curve.  If keys were random that would happen only half the time.  
But without hashing it always happens. I think this has no effect on the 
security of the session communication using AES-256. But it satisfies 
the conditions of various proofs that assume that the key is chosen at 
random.

2.   The hashing provides an opportunity to introduce additional values 
that the Alice and Bob may agree on.  These could be shared secrets, or 
Alice and Bob's identities, or whatever.  Shared secrets make it hard 
for Charlie to mount a man-in-the-middle attack.

3.  Since hashes provide pre-image resistance, the attacker can't learn 
anything about the result of the ECDH protocol, even if he gets the 
session key. This is a nice theoretical touch.  But I can't think of how 
this is an actual advantage.

4. My question specified AES-256.  But if fewer key bits are needed, the 
truncated output after hashing has full entropy, but a truncated X 
coordinate does not.

Thank you,

     --David Jacobson