Score:1

How are RSA and Elliptic Curve keys generated deterministically?

pk flag

Going through the TPM tutorial: https://google.github.io/tpm-js/#pg_keys

Primary keys are derived from the primary seeds using a deterministic key derivation function (KDF).

The output of KDF would be some pseudo-random bytes. For RSA, the bytes might not be a prime number. For elliptic curves, the bytes would likely not be a co-ordinate on the curve. Even ignoring that output is coming from a KDF I'm unclear on how a "seed" can be used to generate RSA and EC keys deterministically.

Maarten Bodewes avatar
in flag
You need at least *two* primes for RSA of about half the key size and an EC private key is not a point, it's a vector, so it cannot be on any curve.
Score:3
ru flag

The primary function takes entropy and converts it into key pairs in different ways. In the case of RSA-2048 it needs to create two random prime numbers of 1024-bits. It will do this roughly as follows. First a string of 1204-bits with the two highest bits and the lowest bit set is (deterministically) derived from the KDF output. This number will be subjected to (possibly randomised) probabilistic primality testing. Randomisation prevents pathological input being passed to the testing function, but all prime testing functions should behave the same: never returning a false negative and statistically highly unlikely to return a false positive. If the number does not test as prime, then it is incremented by 2 and the new number tested and so on. Once we have the first prime we (deterministically) generate a fresh string from the KDF output and repeat to get the second prime. The process will certainly halt at the first prime number greater than the initial string and there is a vanishingly small chance that it will halt before that on a false positive. Although this may be non-deterministic in the intermediate steps, it is overwhelmingly likely to always produce the same two primes. Some processes might only look for primes of a particular form, but the principle still stands.

In the case of elliptic curves, there is not even the chance of a false positive. There is a universal parameter set that consists of a particular curve and a point $G$ on that curve. The primary function converts the seed into an integer $s$ modulo $\ell$ (where $\ell$ is the order of $G$ in the elliptic curve group) in a uniform manner. The primary then computes $sG$ which is a point on the curve and serves as a public key corresponding to the private key $s$. The reduction modulo $\ell$ and the scalar multiplication of $G$ are both deterministic.

Score:0
us flag

To my knowledge, this "random" number is used as a seed and probabilistic primality tests start to take place for numbers near it. Take for example $p$ and $q$ random prime numbers that are required for the RSA-1024. If we get a 1024-bit number then we can start to make probabilistic primality tests for numbers in its neighborhood with margin of error less than that of a hardware error. According to this answer (the code that is mentioned is from OpenSSL and is quite good documented so I recommend you take a look at it) and with further code inspection, given a number $p$ for example first deterministic tests take place for division with small prime numbers and then probabilistic tests take place.

krkhan avatar
pk flag
But wouldn't that make it non-deterministic? How does the TPM generate the same primary keypair each time, wouldn't the primality test find different primes on each run?
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.