SPRUJB6B November 2024 – May 2025 AM2612
These commands perform a scalar multiply on a Montgomery curve such as Curve25519 or Curve448.
This operation is used for key generation or shared secret derivation.
The two commands differ as follows:
If a ROM parameter set is used, the KEYGEN version takes gx from ROM, whereas the SHARED version takes it from memory.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 3 | s0 | First component of XOR-blinded private key. | No |
| 4 | s1 | Second component of XOR-blinded private key. | No |
| 12 | gx | x-coordinate of the elliptic curve’s generator or of the other party’s public key. | Keygen: yes Shared: no |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | A24 | The (A-2)/4 factor of the Montgomery curve. | Yes |
The ECDH_MONTGOMERY_* _EPH commands will raise an error if:
Note that this function does not perform “key clamping” such as is specified in RFC 7748. The client software is responsible for this step.
On error, these commands clear slots 3 through 12. On success, they clear slots 5 through 11.
| Slot | Name | Description |
|---|---|---|
| 12 | px | x-coordinate of the generated public key |