using elliptic curve point multiplication as a key stretching method My friend came up with the following idea: assuming we agreed on curve parameters, use the following algorithm for key stretching/derivation from user-entered password.


Pad the ascii representation of the password to n bits or use any simple hash function, e.g. MD5 to allow passwords of arbitrary length
Compute the resulting key as a multiplication of the curve generator point by the number we got at step #1.


In other words, we consider the user-entered password to be the private key of ECDSA and use the public key derivation algorithm as a key stretching function.

Now this looks pretty simple and effective (my CPU only manages to do less than a couple thousand multiplications per second and it seems there is no way to get significant speedups using GPUs). Is this algorithm actually used anywhere? If not, what are some obvious flaws that I can point to for my friend and make fun of him?

EDIT: Thanks for answers! Can't upvote yet due to low rep. The idea was to use this method as a slow hash function for password hashing (as a replacement for bcrypt for example). IMPROVED VERSION: Assuming we use SHA256 in the first step to hash the entered password, then multiply with the generator point in the p256 curve and use the X coordinate of the resulting point as a 256-bit hash of the password. Is this hash good enough for this purpose?

This is a purely theoretical question of course, we are not going to actually use any homebrew cryptography in our app!
If I understand correctly is to hash your password $pw$ into a point using either $P=Pad(pw)\cdot P_0$ or $P=MD5(pw)\cdot P_0$ and then use $P$ for cryptographic purpose. The exact security of this proposal depends on what you want to do with $P$ exactly. But in some case, this is not secure. Typically, this mechanism is not a good way to hash a password (even if you add salt by varying $P_0$).

Indeed, in this application, you would know $P$ and $P_0$ and recovering the password $pw$ could be done using a discrete logarithm computation. Since $pw$ is generally quite short, $Pad(pw)$ belongs to a short interval of length $N$ (where $N$ is the number of possible padded passwords). In this case, using Pollard's lambda (i.e. The kangaroo method) allows to compute the discrete logarithm at a cost of $\sqrt{N}$. With $MD5$, $N$ is $2^{128}$ which would give a cost of $2^{64}$ to compute the logarithm, probably not enough.

On the other hand, if your application keeps $P$ secret, this is probably not going to apply. So could you tell more about the exact use of $P$ ?