Re: Public Key Extraction in Implicit Certificates (ECQV)

Hi Peter,

Thank you very much for your insightful comments. I hadn't thought of point
3, though our impression is that hash mismatch is impossible, that is: the
Hash function (in this case Matyas Meyers Oseas hashing function (128 bits))
on our side outputs exactly the same as the Hash function in Certicom's
case. Either way, I find very worthwhile to investigate whether Public Key
Extraction having as 0 the Hash still outputs the same CA Public Key.

A little more context on the problem at hand:

Every ZigBee device in the market contains Certicom issued implicit
certificates, not only for initial ZigBee  communications, but for firmware
verification as well. Certicom also gives every ZigBee chip manufacturer
their own elliptic curve lib, eccapi.h, which covers all the use cases where
the devices need to use Elliptic Point crypto.

Namely the function that reconstruct Public Keys given the inputs is:


Reconstructs the remote party's public key using its implicit certificate
and the CA public key.

int ZSE_ECQVReconstructPublicKey(unsigned char* certificate,
                                 unsigned char* caPublicKey,
                                 unsigned char* publicKey,
                                 HashFunc *Hash, 
                                 YieldFunc *yield, 
                                 unsigned long yieldLevel);

where: 
certificate/input is a 48 byte array containing the certificate.
caPublicKey/input is the 22 byte array containing the CA Public Key
publicKey/output is the output, that is, the ECDSA Public Key
HashFunc is a function point to an Hash Function, in this use case, it will
always be MMOHash based on AES-128
YieldFunc/YieldLevel are functions for device watchdogs, to interrupt
computations on the device, so not really relevant here. Certicom's spec for
the function is unknown, as well as test-vectors. What is known is how it
/should/ operate, see Wikipedia or Certicom's own explanation of the ECQV
https://www.certicom.com/content/certicom/en/code-and-cipher/explaining-implicit-certificates-part-2.html

Kind Regards,

Manuel




--
Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html