# Are there any differences in operation between existing Diffie-Hellman specifications?

Are there any differences in operation between existing Diffie-Hellman specifications, especially those within the RSA PKCS#3, ANSI X9.42 and RFC 2631 standards?

-

PKCS#3 is an older standard which only defines the DH primitive itself. It contains the following information: parameter generation, the Diffie Hellman key agreement algorithm, integer/octet string conversions (as in PKCS#1, RSA) and the specification of an ASN.1 structure for the parameters. The ASN.1 structure is very limited, containing only the necessary $p$ and $g$ parameters and an optional privateValueLength parameter.

ANS X9.42 is a much larger specification, which contains a great number of derivative algorithms, including the MQV2 and MQV1 authenticated Diffie-Hellman schemes. With regard to the Diffie-Hellman calculations itself, it contains a method to validate the parameters as well as the public key of the other party. It contains two Key Derivation Functions (KDFs) that are slightly different from each other: one octet string concatenation while the other uses ASN.1 encoding. Both use hashing to derive keys from the generated secret value. Finally the ASN.1 definitions are much more extensive than PKCS#3. The domain parameter structure has a required $q$ parameter, which makes the domain parameter structure incompatible with that of PKCS#3. The base calculation and integer to octet string functions used for the secret value are however identical to PKCS#3. ANS X9.42 also helpfully provides calculation examples.

RFC 2631 is a strict subset of ANS X9.42. It only defines Diffie-Hellman algorithms without authentication. It limits Diffie-Hellman to the ephemeral-ephemeral, ephemeral-static and static-static schemes also present in X9.42. It defines only the ASN.1 based KDF with a specific hash function: SHA-1. The data in this ASN.1 structure is limited as well, but it has not been made static. It contains all the domain parameter and public key parameter validation algorithms. It does however not define any ASN.1 structures for the domain parameters nor the public key. Note that RFC 2631 may not use the same names and identifiers specified in X9.42; it for instance uses "ephemeral-static Diffie-Hellman" for the "dhOneFlow" scheme in X9.42. It also introduces the term KEK for the key generated by the KDF.

Finally NIST Special Publication 800-58A is a document that is based on ANS X9.42. It shows key agreement based on Finite Field Cryptography (what most persons call DH) as well as key agreement based on Elliptic Curve Cryptography. It defines MQV authenticated schemes, but only for ECC. An additional test has been defined for the shared secret value: if $Z$ has the value 1 then an error should be returned. It also contains a slightly different KDF, where the counter is removed from the OtherInfo. It also contains references to NIST Special Publication 800-58C for using a KDF that uses extract-then-expand. Instead of just algorithms a lot of this standard provides indications on how to properly implement the standard. This document seems to be most up to date and provides clearly more information than the other documents.

This answer is based on PKCS#3 Version 1.4, ANS X9.42–2003, RFC 2631 of June 1999 and NIST SP 800 56A: Revision 2, May 2013. Note that ANS X9.42 is not publicly available.

-
If anybody is able to review or extend this answer I would be much obliged. Other answers welcome as well, in case you are interested in the bounty... –  Maarten Bodewes Nov 7 '13 at 11:30
You may also want to consider NIST SP 800-56A: Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography. It is largely based on X9.42. –  user4982 Nov 8 '13 at 20:31
@user4982 Thanks! I will have a look at it! –  Maarten Bodewes Nov 8 '13 at 22:47