Crypto.PubKey.ECC.DH

Define either a binary curve or a prime curve.

ECC Public Point

ECC Private Number

Represent Diffie Hellman shared secret.

Generating a private number d.

Generating a public point Q.

Generating a shared key using our private number and the other party public point.

This raises the CryptoError that tryGetShared reports. Use tryGetShared where the failure has to be handled.

Generating a shared key using our private number and the other party public point, reporting a rejected point instead of raising.

The public point comes from the other party, so it is checked before it is multiplied. A point that does not satisfy the curve equation is reported as CryptoError_PointCoordinatesInvalid.

Satisfying the equation is not by itself membership of the subgroup the base point generates; the two coincide only when the cofactor is 1. On a curve whose cofactor is above 1 the other party can offer a point of small order, and the value that comes back then depends on our private number only through its residue modulo that order, which hands them those bits. So the point is also required to be in the subgroup, by isPointInSubgroup, and is reported as CryptoError_PointSubgroupInvalid when it is not. That check costs one further scalar multiplication, and is skipped where the cofactor is 1 and it cannot fail.

An exchange that yields the point at infinity, and so has no x coordinate to derive the key from, is reported as CryptoError_ScalarMultiplicationInvalid.