Create slip-0017.md

README.md

@@ -19,6 +19,7 @@ Each SLIP should provide a concise technical specification of the feature and a
 | [SLIP-0014](slip-0014.md) | Stress Test Deterministic Wallet                                      | Informational | Draft    |
 | [SLIP-0015](slip-0015.md) | Format for Bitcoin metadata and its encryption in HD wallets          | Standard      | Draft    |
 | [SLIP-0016](slip-0016.md) | Format for password storage and its encryption                        | Standard      | Draft    |
+| [SLIP-0017](slip-0017.md) | Elliptic Curve Diffie-Hellman using deterministic hierarchy           | Standard      | Draft    |
 | [SLIP-0044](slip-0044.md) | Registered coin types for BIP-0044                                    | Standard      | Draft    |
 
 ---

slip-0017.md

+#SLIP-0017 : ECDH using deterministic hierarchy
+
+```
+Number:  SLIP-0017
+Title:   ECDH using deterministic hierarchy
+Type:    Standard
+Status:  Draft
+Authors: Roman Zeyde <roman.zeyde@gmail.com>
+Created: 2016-05-29
+```
+
+##Abstract
+
+This document describes a method for implementing Elliptic Curve
+Diffie-Hellman algorithm, using a determinstic hierarchy.
+
+##Motivation
+
+Using Deterministic Hierarchy for encryption and decryption is ideal,
+because the same concepts of easy backup that relate to backing up
+deterministic wallets can be applied to backing up private keys.
+
+##Service Identity
+
+Let's introduce the service identity. It consists of two elements:
+
+a) RFC 3986 URI `proto://[user@]host[:port][/path]`
+
+Examples:
+
+- https://example.com
+- ftp://public@example.com/pub
+- ssh://root@example.com:2222
+
+b) index (32-bit unsigned integer)
+
+The index is used so one can generate more keys corresponding to the same URI.
+
+## HD Structure
+
+1. First concatenate `index` with the URI (`uri`). Use little endian for `index`.
+
+2. Compute the SHA256 hash of the result (`hash`).
+
+3. Truncate `hash` to 128 bits (`hash128`)
+
+4. Split `hash128` into four 32-bit integers `A`, `B`, `C`, `D`. Use little endian for each.
+
+5. Set highest bits of numbers `A`, `B`, `C`, `D` to 1 (e.g. logical OR with 0x80000000) to harden
+
+6. Derive the HD node `m/17'/A'/B'/C'/D'` according to BIP32.
+
+##Shared secret generation
+
+Suppose that Alice and Bob need to agree on a shared secret.
+
+First, they agree on a specific elliptic curve and generate
+two public keys: `P1 = k1*G` for Alice and `P2 = k2*G` for Bob.
+
+In order to derive a shared secret, Alice retrieves Bob's public key (P2).
+Then, she calls `Q = GetECDHSessionKey(P2)` API on her TREZOR, to compute
+`Q = k1*P2`, by multiplying Bob's public key `P2` (as an elliptic curve point)
+by her private key `k1` (as a 256-bit scalar).
+
+The result is the elliptic curve point `Q = k1*k2*P`, which can be computed in a
+similar way by Bob (since `Q = k2*P1`), is used to derive a shared secret.
+
+## References
+
+- [BIP-0032: Hierarchical Deterministic Wallets](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki)
+- [BIP-0043: Purpose Field for Deterministic Wallets](https://github.com/bitcoin/bips/blob/master/bip-0043.mediawiki)
+- [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax](https://tools.ietf.org/html/rfc3986)