Re: [Cfrg] uniform random distribution in ECDH public key

On 08/14/2012 02:26 PM, David McGrew (mcgrew) wrote:
> Hi Bob,
>
> On 8/14/12 2:01 PM, "Robert Moskowitz" <rgm-sec@htt-consult.com> wrote:
>
>> I understand from RFC 6090 and 5869 that the secret key produced from an
>> ECDH exchange is not uniformly randomly distributed and that is why we
>> have the 'Extract' phase in HKDF.  Got that.
>>
>> This question is about the public key, g^j:
>>
>> I understand that like j, it must be a point on the curve, thus if the
>> curve is p-256, both j and g^j are 256 bits long.  But is g^j uniformly
>> randomly distributed like j is suppose to be?
> Something quick to add to what Scott said.   Note that j is uniformly
> random when considered as an integer between 1 and the group order; it is
> not uniformly random when considered as a bit string.

AH! Important clearification.

But this means that on the curve, the possible points are uniform. I 
thought that they need to be prime values? I am getting more confused, I 
think, as I think about this!

>
> David
>
>> Side question:  I am still unclear on the length of the exchanged secret
>> (g^j)^k, is it 256 bits (for p-256) or larger (perhaps 512 bits)?
>>
>> Thank you for helping me get all this straight.
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> http://www.irtf.org/mailman/listinfo/cfrg
>