In TLS, the first step towards obtaining TLS session keys is to compute a shared secret between the client and the server by running the [ECDH protocol](https://en.wikipedia.org/wiki/Elliptic-curve_Diffie–Hellman). The resulting shared secret in TLS terms is called the pre-master secret `PMS`.
Using the notation from Wikipedia, below is the 3-party ECDH protocol between the `Server` the `Client` and the `Notary`, enabling the `Client` and the `Notary` to arrive at shares of `PMS`.
1.`Server` sends its public key \\(\small{Q_b}\\) to `Client`, and `Client` forwards it to `Notary`
2.`Client` picks a random private key share \\( \small{d_c} \\) and computes a public key share \\( \small{Q_c = d_c * G} \\)
3.`Notary` picks a random private key share \\( \small{d_n} \\) and computes a public key share \\( \small{Q_n = d_n * G} \\)
4.`Notary` sends \\( \small{Q_n} \\) to `Client` who computes \\( \small{Q_a = Q_c + Q_n} \\) and sends \\( \small{Q_a} \\) to `Server`
5.`Client` computes an EC point \\( \small{(x_p, y_p) = d_c * Q_b} \\)
6.`Notary` computes an EC point \\( \small{(x_q, y_q) = d_n * Q_b} \\)
7. Addition of points \\( \small{(x_p, y_p)} \\) and \\( \small{(x_q, y_q)} \\) results in the coordinate \\( \small{x_r} \\), which is `PMS`. (The coordinate \\( \small{y_r} \\) is not used in TLS)
Using the notation from [here](https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#Point_addition), our goal is to compute
Since this is finite field arithmetic, if \\( \small{x_r > p} \\) we must reduce \\( \small{x_r} \\) modulo \\( \small{p} \\), i.e assign \\( \small{x_r} \\) the value \\( \small{x_r \bmod p} \\). The trailing \\( \small{\bmod p} \\) is always implied from here on out, but may be omitted for brevity.
> For the curious, the modulus of the most common EC curve P-256 is a prime number and its value is \\( \small{p = 2^{256} - 2^{224} + 2^{192} + 2^{96} - 1}\\)
Based on [Fermat's little theorem](https://en.wikipedia.org/wiki/Fermat's_little_theorem):
\\[ a^{-2} \bmod p = a^{p-3} \bmod p \\]
Replacing the negative power of Equation (2), we get:
> Note that here \\( \small{N_A} \\) (as well as \\( \small{N_b} \\) and \\( \small{N_B} \\) below) is crucial, as without it `Notary` would be able to factorize \\( \small{A * M_A} \\) and learn \\( \small{A} \\)
6. Decrypts and gets \\( \small{A * B + C + S_q} \\)
7. Computes additive `PMS` share \\( \small{s_p = (A * B + C + S_q) \bmod p} \\)
The protocol described above is secure against `Notary` sending malicious inputs. Indeed, because `Client` only sends back masked values, `Notary` cannot learn anything about those values.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sinu