Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, \hat{A}, \hat{B})$ 4-tuple.

However, the paper isn't particularly clear whether a party can use multiple, potentially attacker-controlled, identities.

share|improve this question
    
It would be beneficial, if you provided a reference, to what scheme you're referring to. Google scholar told me, but it also gave a hit for Another Look at HMQV from A. Menezes. Maybe have a look at it, because that paper claims, HMQV is insecure. I didn't get further than the abstract in both papers, tho. –  tylo Sep 29 at 14:20

1 Answer 1

I think you are not familiar with the PKI-based setting. In the PKI-based setting, each user owns a certificate that binds his/her identity with his/her public key. If a user uses multiple identities with one public key, that means he/she must use same public key with a different identity to register many times, at this point he/she will receive different certificates(the number of which is the number of the identities belonging to a user). Well, this is very easy to avoid in the $\mathcal{CA}$, it is only required that repeated registering is not allowed.

Actually, even if this case happens, then HMQV is still secure only if the secret key corresponding to the same public key isn't compromised.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.