Web Crypto与NodeJS Crypto基于P-521/secp521r1的ECDH共享密钥末尾不一致问题

密钥生成实现 #

• NodeJS端私钥生成函数实现：

function _genPrivateKey(curveName = "secp384r1", encoding = "hex") {
    const private_0 = crypto.createECDH(curveName);
    private_0.generateKeys();
    return private_0.getPrivateKey().toString(encoding);
}

• Bob端（NodeJS侧）固定测试参数：
  • 十六进制私钥：

  9d0c809d692c83c7d8d1355205dd78e679066fd9c15d12cdea3e1103b041873765264351e8939083b876d89d423301d8486a956da455ddbdc4a91ef60af7dd2325
  

  • 十六进制未压缩格式公钥：

  0400d7a342e89f501e1cd8224e2463ef1ad057c9b64bf45c1d3627cc1f06c055c80f75c2013c27b63dc984b467ecfc5202cf9a126ef1f1487e92b9acfb52abaeb7022e01f4259918ca34f442214a31d1bad329f9be1c67ce98af6621f622e44887264e856ee8c664a51e56f24008c932ee1cb5514c02d03ba27f6b6a1cd0aa0f8eac261250
  

  • JWK格式公钥：

  {
    key_ops: [ 'deriveKey' ],
    ext: true,
    kty: 'EC',
    x:'ANejQuifUB4c2CJOJGPvGtBXybZL9FwdNifMHwbAVcgPdcIBPCe2PcmEtGfs_FICz5oSbvHxSH6Suaz7UquutwIu',
    y:'AfQlmRjKNPRCIUox0brTKfm-HGfOmK9mIfYi5EiHJk6FbujGZKUeVvJACMky7hy1UUwC0Duif2tqHNCqD46sJhJQ',
    crv: 'P-521'
  }
  

• Alice端（Web侧）密钥生成实现：

const generateAlicesKeyPair = window.crypto.subtle.generateKey({
        name: "ECDH",
        namedCurve: "P-521"
    },
    false,
    ["deriveBits"]
);

• Alice端十六进制未压缩格式公钥：

04000eefa90c3de22e79e6742f807806a603059d16afaa9f1bc69f420050aae100d0006e6510fe17a8f6767fe1e69bada039175ef5a375e30af4085e4315cf7527655f00ed9a39552a5f9170cc7626c1f4584d0e6de17870e336bcc5b6e251e3ea2c7cd9633e1afe2f9aee5f9a7445d38218c20695cc7ba2a462b67ce39a060e6464133609

共享密钥推导实现 #

• NodeJS侧共享密钥推导函数：

function _getSharedSecret(privateKey, publicKey, curveName = "secp521r1", encoding = "hex") {
    const private_0 = crypto.createECDH(curveName);
    private_0.setPrivateKey(privateKey, encoding);
    const _sharedSecret = private_0.computeSecret(publicKey, encoding);
    return _sharedSecret
};

• Web Crypto侧共享密钥推导调用：

const sharedSecret = await window.crypto.subtle.deriveBits({
        name: "ECDH",
        namedCurve: "P-521",
        public: publicKey
    },
    privateKey, 
    521
);

问题现象 #

• 曲线适配差异：仅使用P-521/secp521r1曲线时，两端生成的共享密钥存在末尾比特值不一致的异常；使用P-256/secp256r1、P-384/secp384r1曲线时无该问题。
• 实际推导结果对比：

// NodeJS端推导结果
0089b99212c9348a6fd3aa78225a773a90ef45f57bbd10dc86d8e52fa26662c550b56d2368ee358ab240ceec10191b6cdd7d09bb0a8763ea48a487a5676ebdf7af[eb]

// WebCryptoAPI端推导结果
0089b99212c9348a6fd3aa78225a773a90ef45f57bbd10dc86d8e52fa26662c550b56d2368ee358ab240ceec10191b6cdd7d09bb0a8763ea48a487a5676ebdf7af[80]

待解决需求 #

• 定位该跨平台密钥推导差异的产生原因
• 获取适配P-521/secp521r1曲线的两端结果一致性解决方案

内容的提问来源于stack exchange，提问作者jay