Re: [Cfrg] uniform random distribution in ECDH public key

thank you. I was using the compact notation (x-coordinate only) for the 
256bit size with p-256. I should have said that.

On 08/14/2012 02:14 PM, Scott Fluhrer (sfluhrer) wrote:
> No, the value g^j (or jG,

And I am going by 6090. Sometimes I suspect the notation used there is 
to distance it from more 'modern' usages as appear in certain documents 
filed with a department of the US gov. But that is pure speculation.

>   if we prefer the more traditional additive notation for elliptic curves) is not uniform; it is a 512 bit value (for P256), and corresponds to a point on the curve (that is, it is a pair of 256 bit values that together are a solution to a specific cubic equation).  There are approximately 2^256 possible values for this 512 bit value, and so there are a large number of 512 bit public values which are not possible.

Is there any information of the distribution of jG?

>
> -----Original Message-----
> From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf Of Robert Moskowitz
> Sent: Tuesday, August 14, 2012 2:02 PM
> To: cfrg@irtf.org
> Subject: [Cfrg] uniform random distribution in ECDH public key
>
> I understand from RFC 6090 and 5869 that the secret key produced from an
> ECDH exchange is not uniformly randomly distributed and that is why we
> have the 'Extract' phase in HKDF.  Got that.
>
> This question is about the public key, g^j:
>
> I understand that like j, it must be a point on the curve, thus if the
> curve is p-256, both j and g^j are 256 bits long.  But is g^j uniformly
> randomly distributed like j is suppose to be?
>
> Side question:  I am still unclear on the length of the exchanged secret
> (g^j)^k, is it 256 bits (for p-256) or larger (perhaps 512 bits)?
>
> Thank you for helping me get all this straight.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>