Skip to content

Latest commit

 

History

History
72 lines (46 loc) · 2.33 KB

slip-0017.md

File metadata and controls

72 lines (46 loc) · 2.33 KB
Raw

SLIP-0017 : ECDH using deterministic hierarchy

Number:  SLIP-0017
Title:   ECDH using deterministic hierarchy
Type:    Standard
Status:  Final
Authors: Roman Zeyde <roman.zeyde@gmail.com>
Created: 2016-05-29

Abstract

This document describes a method for implementing Elliptic Curve Diffie-Hellman algorithm, using a determinstic hierarchy.

Motivation

Using Deterministic Hierarchy for encryption and decryption is ideal, because the same concepts of easy backup that relate to backing up deterministic wallets can be applied to backing up private keys.

Service Identity

Let's introduce the service identity. It consists of two elements:

a) RFC 3986 URI proto://[user@]host[:port][/path]

Examples:

  • https://example.com
  • ftp://public@example.com/pub
  • ssh://root@example.com:2222

b) index (32-bit unsigned integer)

The index is used so one can generate more keys corresponding to the same URI.

HD Structure

  1. First concatenate index with the URI (uri). Use little endian for index.

  2. Compute the SHA256 hash of the result (hash).

  3. Truncate hash to 128 bits (hash128)

  4. Split hash128 into four 32-bit integers A, B, C, D. Use little endian for each.

  5. Set highest bits of numbers A, B, C, D to 1 (e.g. logical OR with 0x80000000) to harden

  6. Derive the HD node m/17'/A'/B'/C'/D' according to BIP32.

Shared secret generation

Suppose that Alice and Bob need to agree on a shared secret.

First, they agree on a specific elliptic curve and generate two public keys: P1 = k1*G for Alice and P2 = k2*G for Bob.

In order to derive a shared secret, Alice retrieves Bob's public key (P2). Then, she calls Q = GetECDHSessionKey(P2) API on her TREZOR, to compute Q = k1*P2, by multiplying Bob's public key P2 (as an elliptic curve point) by her private key k1 (as a 256-bit scalar).

The result is the elliptic curve point Q = k1*k2*P, which can be computed in a similar way by Bob (since Q = k2*P1), is used to derive a shared secret.

References