对于EC公钥有标准化的固定长度编码吗？ [英] Is there a standardized fixed-length encoding for EC public keys?
问题描述
我想知道对于每个曲线类型，对于ECDH（椭圆曲线Diffie-Hellman）和ECDSA（椭圆曲线数字签名算法），是否存在（我希望有）公开密钥大小的标准，
如果您使用一个命名曲线，那么公钥大小为
压缩与未压缩的表示
键大小进一步取决于是否使用未压缩表示或压缩表示。在未压缩形式中，公钥大小等于字段大小（以字节为单位）的两倍+1，在压缩形式中为字段大小+1。因此，如果您的曲线定义在 secp256r1 （也称为 NIST P-256 或 X9.62 prime256v1 ），则字段大小为256位或32字节。因此，公钥在压缩形式下将为65字节（32 * 2 +1）长，而在压缩形式下为33字节（32 +1）长。
未压缩的表单包含0x04（类似于 DER OCTET STRING标记）加上X坐标的二进制表示加上公共点的y坐标的二进制表示的连接。
GF（2 ^ p）case
如果底层字段是GF（2 ^ p） y可以被认为是来自[0，n-1]的元素。它们是按照通常的方式对整数进行编码，并且填充完整的log2（p）/ 8字节的剩余空间用零填充。
GF（2 ^ m）case对于GF（2 ^ m），x和y可以被认为是具有系数a_i 0或1的多项式a_0x_0 + ... + a_m-1。它们的二进制表示是简单的系数的级联。
进一步阅读
确切的细节可以在 SEC1v2 。 （特别是第10和11页的 2.3.3椭圆 - 曲线 - 点到八位字符串转换部分。）
I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type over prime fields (192, 224, 256, 384 and 521).
If you use one of the "named curves" then the public key size is fixed and dependent on the "field size" of your underlying curve.
Compressed vs. uncompressed representation
Public key sizes further depend on whether the "uncompressed" representation or the "compressed" representation is used. In the uncompressed form, the public key size is equal to two times the field size (in bytes) + 1, in the compressed form it is field size + 1. So if your curve is defined on secp256r1 (also called NIST P-256 or X9.62 prime256v1), then the field size is 256 bits or 32 bytes. And therefore the public key would be exactly 65 bytes (32*2 +1) long in the uncompressed form and 33 bytes (32 +1) long in the compressed form.
The uncompressed form consists of a 0x04 (in analogy to the DER OCTET STRING tag) plus the concatenation of the binary representation of the X coordinate plus the binary representation of the y coordinate of the public point.
GF(2^p) case
If the underlying field is GF(2^p) then x and y can be thought of as elements from [0, n-1]. They are encoded the usual way integers are encoded and the remaining space to fill exactly log2(p)/8 bytes is padded with zeroes.
GF(2^m) case
For GF(2^m) x and y can be thought of as polynomials a_0x_0 + ... + a_m-1 with coefficients a_i 0 or 1. Their binary representation is simply the concatenation of the coefficients.
Further reading
The exact details can be found in SEC1v2. (Especially section 2.3.3 Elliptic-Curve-Point-to-Octet-String Conversion on pages 10 and 11.)
这篇关于对于EC公钥有标准化的固定长度编码吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
