Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret.

The question is: Is it safe for Alice and/or Bob to reuse their keypairs to negotiate a new AliceCarol and/or BobCarol secret?

The intended use is authentication. Each party can persistently store the others' public keys, and persistently store or deterministically recreate their own private keypair. Each party could establish a new communication channel with another party at a later time, verify that the other party's current public key matches their previous public key, generate a random message M and send it to the other party. The other party can then use the negotiated secret to HMAC sign M to generate M' and send M' back. At this point, M' can be verified by the originating party re-calculating M' using the negotiated secret, thus validating the other party's identity.

share|improve this question

2 Answers 2

Yes, the same keypairs can be used to derive shared secrets between multiple pairs of parties.

If knowing the shared secret between Alice and Bob would help Eve find out the shared secret between Alice and Carol, Eve could just create her own random private key and calculate a "shared" secret between that key and Alice's public key to get the same advantage.

share|improve this answer

Such keys are called static keys. Keys that are newly generated each time are called ephemeral keys. Note that you need to trust the public keys of the key pairs to use them for authentication.

Please note that there is an issue if you use static keys only for plain Diffie-Hellman: the generated secret will be static as well, as the whole scheme has now become deterministic. The solution for this is to send a nonce as well as a public key by one of the parties.

More information in chapter 6 of NIST SP 800-56B, specifically 6.3 Scheme Using No Ephemeral Key Pairs, C(0, 2).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.