# Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication.

We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting secret as an IV.

I want to know if there can be any attack on this system: is it possible to perform a man-in-the-middle attack or a replay attack?

-

## migrated from stackoverflow.comJul 28 '14 at 20:42

This question came from our site for professional and enthusiast programmers.

Welcome in advance to crypto, Yoav R. :) I've removed the general description of Diffie-Hellman from your question, the people here will know what you are talking about. – Maarten Bodewes Jul 28 '14 at 23:55
There's no need/reason to use Diffie-Hellman to generate a nonce. Instead, have Alice generate one nonce $N_A$, and have Bob generate another nonce $N_B$, and use both nonces -- or use the hash $H(N_A || N_B)$ as your random value. Alternatively, if all you want is an IV for a symmetric-key cryptosystem, you don't need them to cooperate to form a nonce: just have the sender generate the IV randomly. Both endpoints are presumably trusted (since they both know the shared key) and had better have been authenticated, so there's no need to combine both of their contributions to form the IV. – D.W. Jul 29 '14 at 6:03
@owlstead - thanks. – Yoav R. Jul 29 '14 at 6:28
@D.W. - Your first suggestion (using both nonces as input for the hash, that I use as IV) is good, but again - uses contribution from both sides. Your second suggestion is not good, as it is open to replay attack(If only Alice"create" the nonce, Bob must believe that it was contacted by the by Alice, even if he was contacted by an attacker). – Yoav R. Jul 29 '14 at 6:30
Just a question to be sure I completely understand your status-quo: is there any reason for you not to use a Password-Authenticated Key (PAK) Diffie-Hellman Exchange (as described in RFC5683)? – e-sushi Jul 29 '14 at 8:59

Yes, it's secure.

It is somewhat overkill, however, since you could stop replay attacks by using either:

1. a persistent counter as IV, or
2. a random nonce, and including a timestamp in the message.

The AEAD must authenticate the IV (and GCM certainly does), so either would work without requiring any extra round-trips. You can just use the IV in the initial message and have the other party pick it up from there as needed.

If you do use Diffie–Hellman, you might as well use the shared secret as a session key instead of a nonce. That way you also get perfect forward secrecy, with ephemeral D–H keys. In that case the initial nonce could just be random, since there's nothing to replay with that key.

And yes, the other answer is correct that Diffie–Hellman is vulnerable to MitM, so you should authenticate the key exchange messages using the long term key.

-

This algorithm is vulnerable to a Man in the middle. From Wikipedia:

In the original description, the Diffie–Hellman exchange by itself does not provide authentication of the communicating parties and is thus vulnerable to a man-in-the-middle attack. Mallory may establish two distinct key exchanges, one with Alice and the other with Bob, effectively masquerading as Alice to Bob, and vice versa, allowing her to decrypt, then re-encrypt, the messages passed between them. Note that Mallory must continue to be in the middle, transferring messages every time Alice and Bob communicate. If she is ever absent, her previous presence is then revealed to Alice and Bob. They will know that all of their private conversations had been intercepted and decoded by someone in the channel.

A method to authenticate the communicating parties to each other is generally needed to prevent this type of attack. Variants of Diffie–Hellman, such as STS protocol, may be used instead to avoid these types of attacks.

-
That is nice ( and I did read it). But it does not apply to my system. I only exchange nonce with Diffie Hellman. If MITM attack is occurring , after 2 messages of agreeing on the nonce, the attack will fail in the encryption phase. No one but Alice and Bob knows the key. – Yoav R. Jul 28 '14 at 9:49

Using Diffie-Hellman key agreement for generating a nonce should be safe as long as both key pairs are ephemeral, i.e. generated for each run of the key agreement protocol. Otherwise a man-in-the-middle can fool one of the parties in generating the same nonce over and over again.

Ephemeral Diffie-Hellman is however overkill for generating a nonce, as the nonce does not have to be secret. So what you can do is to generate a (random) nonce, and send it authenticated with the authentication tag to the other party, together with the initial encrypted message for instance.

To add the IV to the authentication tag, you may have to make it part of the additional authenticated data (AAD). GCM and CCM already include the counter and thus the nonce in the calculation of the tag. I'm presuming an authenticated block cipher with associated data (AEAD) such as GCM here.

Of course, if you have a good source of random numbers and enough bandwidth, you could just create a new (authenticated) nonce for each encrypted message.

-
" as long as both key pairs are" - what key pairs? I have only one key (pre shared between Alice and Bob). Im not sure how can one fool one party to generate the same nonce over and over-both parties generate random number(x or y)and sends g^x (or g^y) to the other party(of course, in Zp)so,I would like to have more detailed explanation on the attack.Im not sure what ephemeral Diffie-Hellman means(although ephemeral key is understood and cannot be used). Your idea of using the IV in the AAD is great,but we have limited message bandwidth so I think we won't use this idea.we use cipher with AEAD – Yoav R. Jul 29 '14 at 6:43
The "key pairs" used for the Diffie-Hellman protocol. If you generate new x and y each time, it would be an ephemeral-ephemeral DH protocol, and you would be OK. As for the bandwidth, just sending over the (authenticated) nonce/IV once seems less overhead than a full DH protocol to me. – Maarten Bodewes Jul 29 '14 at 7:47
With once I mean in the initial message. If you can keep the number synchronized then you don't need it afterwards. Note that if you have a message counter somewhere you already have a nonce. Even if not present, it's a good idea to make sure that the nonce is taken into account in the authentication tag. Heh, forgot that this is already the case for GCM mode of authentication. – Maarten Bodewes Jul 29 '14 at 9:00
I cannot trust the parties to keep the number synced, as there can be communication breakdown, so one can get ahead, while the other will stay behind in the count. Yes - I want full DH ephemeral-ephemeral. – Yoav R. Jul 29 '14 at 9:34
But the fact remains that the nonce does not have to be kept secret, and that GCM authentication already includes the nonce. In the end, just sending the nonce (at startup & when sync fails) is a whole lot less overhead than performing DH, both with regards to computation time and message size. – Maarten Bodewes Jul 29 '14 at 10:53