Why do you need random number for ECDH shared key computation

Question

Let's assume that authentication with certificates has been well performed, next step is to generate short-term private&public ECC keys for ECDH shared key computation.

• Alice: Generates keyA with RNG and calculates pubkeyA, shares pubkeyA with Bob

• Bob: Generates keyB with RNG and calculates pubkeyB, shares pubkeyB with Alice

Both sides calculate the same shared: pubkeyB * keyA = keyB * pubkeyA

In mbedTLS library, mbedtls_ecdh_compute_shared requires random number, even if I already have my private and counter-party public key.

Why do we need random number when we generate the computation of publicA*privateB and vice-versa? What random number does here, if still both sides generate same result?

Answer 1

See the documentation for the mbedtls_ecdh_compute_shared() function here.

Note where it reads:

If f_rng is not NULL, it is used to implement countermeasures against side-channel attacks. For more information, see mbedtls_ecp_mul().

The documentation for the mbedtls_ecp_mul() provides more detail. But, in essence, it seems that the random value passed to the mbedtls_ecdh_compute_shared() function is used to thwart timing attacks.

It seems that the author of this library was concerned about a timing attack, where an attacker might try to gain some information about the private key passed to the mbedtls_ecdh_compute_shared() function, based on the amount of time that it takes for the EC multiplication operation in this function to process. To thwart an attack of this nature, the processing time of the function is based on the random value passed to this function, instead of the private key.