Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly including key confirmation. Now they want to use the new $K'$s for the first time and on all subsequent messages.

TLS has specific activation steps involving the messages ChangeCipherSpec and Finished. But in the context of a bandwidth-limited network, such a talkative protocol may not be desirable.

Should I be aware of other protocols that have well-discussed activation routines?
Are there common pitfalls to think of when activating newly established symmetric session keys?

Intuitively I would use something like:
$I$ sends the activation message to $R$ protected by the old keys.
Alternative 1: $R$ replies ok using the new keys. Subsequent messages use the new keys.
Alternative 2: $R$ replies error using the old keys. Subsequent messages use the old keys.

Or more formally:
$n$ - identifier of the previous key establishment process implying an identifier for the new keys $K'$
$H(K, M)$ - HMAC of message $M$ using key $K$

$I \rightarrow R: (I, R, n, Activate)_{K_{enc}}, H(K_{auth}, I||R||n||Activate)$
$R \rightarrow I: (R, I, n, ActivateOk)_{K'_{enc}}, H(K'_{auth}, R||I||n||ActivateOk)$
$R \rightarrow I: (R, I, n, ActivateFail)_{K_{enc}}, H(K_{auth}, R||I||n||ActivateFail)$

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.