Subject: [Cfrg] draft-irtf-cfrg-curves question

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Dec 2015 11:14:43 -0800

In the process of going through an implementation and dealing with the
latest set of questions about non reduced public keys, I ended up with a
question that has some implementations

If the public key I am given has not be reduced, then I compute

K_B' = K_B mod p

Now when I run the KDF function, I am supposed to include K, K_A and K_B in
the key derivation step.  The question is should I be using K_B or K_B'?

Given that the reduction is described as being computed by the routine
computing K, I would think that using K_B makes more sense as K_B' would not
normally be returned from that function.  However it does mean that there
are going to be two different values of K_B that compute the same K and one
needs to make sure that one never computes and saves K_B' and start
distributing it as it would then be potentially impossible to compute the
correct KDF result.

Does this mean that we need to have stronger language on only sending K_B'
rather than K_B when encoding public keys?

Jim

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 28 Dec 2015 21:29:54 +0200

> the key derivation step.  The question is should I be using K_B or K_B'?

Well, as a datapoint, do that in TLS 1.3 or TLS 1.2-EMS and it will hash K_B
(as it would in SSH).

And with ECDH-ES/ECDH-SS, that's matter of distributing the public keys
correctly.

-Ilari