SPRUJB6B November 2024 – May 2025 AM2612
These commands generate a public ECDH key (x-coordinate only) from a private key. The ECDH_KEYGEN_EPH command is suitable for ephemeral public keys and the ECDH_KEYGEN_LT command is suitable for long-term ones. In principle, ECDH_KEYGEN_EPH could use less conservative power analysis protection techniques, and therefore could be faster, because the adversary is assumed only to have access to two traces (keygen and shared) before the private key is destroyed. However, currently they both use the same blinding techniques, which are relatively conservative.
The ECDH_KEYGEN commands take a private key in the additively DPA-blinded format that is the output of ECC_KEY_BLIND.
Input map:
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 3 | s0 | First component of blinded private key. | No |
| 4 | s1 | Second component of blinded private key. | No |
| 10 | b | b-coefficient of the elliptic curve | Yes |
| 11 | gx | x-coordinate of the elliptic curve’s generator | Yes |
| 12 | gy | y-coordinate of the elliptic curve’s generator | Yes |
| 13 | q | Order of the subgroup generated by (gx,gy). Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | a | a-coefficient of the elliptic curve | Yes |
The ECDH_KEYGEN commands will raise an error if:
On error, these commands clear slots 1 through 12. On success, they clear slots 1,2 and 5 through 10 and 12.
Output memory map:
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of the private key, reblinded |
| 4 | s1 | Second component of the private key, reblinded |
| 11 | Px | x-coordinate of the generated public key |