Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure?
Alice selects a random $a$ and sends $g^a \mod p$ to Bob
Bob selects a random $b$, computes the shared secret $S = (g^a \mod p)^b$
Bob computes two keys using HKDF ($H(k, m)$ denotes the HMAC of message $m$ using key $k$):
- Compute $k = H(salt, S)$
- Compute $k_1 = H(k, CTX || 0)$ and $k_2 = H(k, CTX || 1)$
Bob sends $g^b \mod p$, $H(k_1, k_2)$, the salt, and the string CTX to Alice
Alice computes the shared secret $S = (g^b \mod p)^a$, computes $k_1$ and $k_2$ using HKDF given the salt and the string CTX
Alice computes $H(k_1, k_2)$ and verifies whether it's the same as the value that she received from Bob.