2

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to another?

Is this a good idea? (What faults could crop up when doing so?)

My goal is to allow for two independent crypto systems based on ECDSA or subgroups to share the same keys via a conversion of some type

Mike Edward Moras
  • 18,161
  • 12
  • 87
  • 240
makerofthings7
  • 2,631
  • 1
  • 22
  • 37

1 Answers1

3

If what you want is some kind of algorithm that takes a public key $Q = aP$ on one curve and converts it into $Q' = a P'$ on the other curve, then the answer is almost certainly no. There are no "interesting" maps between curves with different group structures.

If you just want to use the same secret key for both curves, so $Q = aP$ on one curve and $Q' = aP'$ on another, $P,P',Q,Q'$ public, that isn't obviously a bad idea. It seems plausible that the obvious DDH-like problem is hard. However, doing this does introduce a bunch of technical problems, e.g. how do you prove that your public keys correspond to the "same" private key (which can be solved, but is tricky when the group orders are different).

K.G.
  • 4,947
  • 19
  • 34