SPRUJB6B November 2024 – May 2025 AM2612
These commands calculate an ECDH shared secret from a private key and the other party’s public key. The EPH version is suitable for ephemeral private keys. It includes relatively conservative blinding, but no protection against refined power analysis. The LT version internally adds a random multiple of the curve order q to each key share, which defends against RPA and ZPA at the cost of slower operation.
The ECDH_SHARED commands take a private key in the additively DPA-blinded format that is the output of ECC_KEY_BLIND.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 3 | s0 | First component of blinded private key | No |
| 4 | s1 | Second component of blinded private key | No |
| 10 | b | b-coefficient of the elliptic curve | Yes |
| 11 | px | x-coordinate of other party’s public key | No |
| 13 | q | Order of the subgroup generated by (gx,gy). Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | a | a-coefficient of the elliptic curve | Yes |
The ECDH_SHARED_EPH and ECDH_SHARED_LT commands will raise an error if:
On error, ECDH_SHARED_EPH and ECDH_SHARED_LT clear slots 1 through 12.
On success, they clear slots 1,2, 5-10 and 12.
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of the private key, reblinded |
| 4 | s1 | Second component of the private key, reblinded. |
| 11 | sx | x-coordinate of the shared secret point |