aead / ecdh

A generic ECDH implementation
MIT License
57 stars 16 forks source link

Fix length of generated key for generic curves #5

Open matluca opened 2 years ago

matluca commented 2 years ago

According to RFC4492 section 5.10 "the premaster secret is the x-coordinate of the ECDH shared secret elliptic curve point represented as an octet string. Note that this octet string (Z in IEEE 1363 terminology), as output by FE2OSP (Field Element to Octet String Conversion Primitive), has constant length for any given field; leading zeros found in this octet string MUST NOT be truncated."

Therefore, FillBytes() and not Bytes() must be used to convert the x-coordinate into []byte.

Notice that this is also done by the standard golang/tls library when implementing Diffie-Hellman. (https://github.com/golang/go/blob/master/src/crypto/tls/key_schedule.go#L176)