2

If an attacker were just given 256 bits, and they were either a SHA256 hash or a 256 bit elliptic curve key, would they be able to tell which one it is?

Just out of curiosity, would they be able to tell the difference between the above and an AES256 encrypted block, or a 256 bit ECDSA signature?

2

Your main assumption that key size is directly related to the format of the keys, parameters or output size does not hold.

Normally the attacker would only have access to a public EC key, which is (usually) not 256 bit, but a point on the curve. This point consists of two coordinate values prefixed with an indicator (compressed or uncompressed points).

Usually a key - public or private - would be encoded using some kind of ASN.1 DER structure (PKCS#8/X9.62). So the format of either keys is usually much larger than the key size. This is different from e.g. symmetric ciphers where the keys just consist of random bits.

ECDSA signatures - just like ECDSA public keys - consist of two components with the (approximate) size of the ECC key size. Usually the signature is ASN.1 DER encoded as well. So it would be pretty easy to distinguish it from a AES256 encrypted block.

All that said, EC private keys (parameter S) are normally fully randomized. And as the output of SHA256 should also look perfectly random to an attacker, there would be nothing to distinguish between the two.

However, if the attacker has access to the key or hash, you would expect that they would also have access to some plaintext/ciphertext combination to verify which algorithm was used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.