Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, \hat{A}, \hat{B})$ 4-tuple.

However, the paper isn't particularly clear whether a party can use multiple, potentially attacker-controlled, identities.

share|improve this question

1 Answer 1

I think you have not familiar with the PKI-based setting, in the PKI-based setting, each user own a certificate that binds his/her identity with his/her public key. If a user uses multiple identities with one public key, that means he/she must use same public key with different identity to register many times, at this time he/she will receive different certificates(the number of which is the number of the identities belong to a user). Well, this occasion is very easy to avoid in the $\mathcal{CA}$, it just require that repeat register is unallowable.

Actually, even this case happens, then HMQV is still secure only if the secret key corresponding to the same public key doesn't compromise.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.