Hashing a Diffie-Hellman result In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that:


  Hashing the shared secret point prevents an attacker from gaining more information about the EC private keys used to generate the shared point.


Could someone give me an example of how to get information about the private key with a shared secret that isn't hashed?
I have never heard of this reason, and I don't quite understand it. In general, the security of Diffie-Hellman key exchange is reduced to the DDH assumption. According to this assumption, the result of the key exchange is a group element that is computationally indistinguishable from a random/uniformly distributed element in the group. However, what is important to note is that a uniformly distributed group element is not a uniformly distributed string (where the latter must have each bit equal 0 with probability 1/2 and equal 1 with probability 1/2). In particular, if you work in $\mathbb{Z}_p^*$ then the most significant bit will certainly not be uniformly distributed. Likewise, if you are working in an Elliptic curve group, then the result is a pair of field elements which fulfill the Elliptic curve equation. Therefore, in order to derive a uniformly distributed string, you need to apply a function that extracts a uniform string from a high entropy source. These are called extractors or key derivation functions. This is the reason that you hash.

I note that it's possible to prove the security of Diffie-Hellman key exchange under the CDH assumption and in the random oracle model. In this case, the hash function is needed to get a long pseudorandom string from a computational assumption. However, I think that explaining this here will be "too much information".