Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key pairs are used to do this, so it would seem that if the shared secret is compromised, then they that particular pair of key sets can't be used again because they would arrive upon the same number as before. Do I have this right?

share|improve this question
This is the same problem for any key exchange protocol. If the shared key is compromised, then Alice and Bob can't communicate secrectly. ECDH is the EC version of DH exchange protocol, and is based on the intractability of DLP. Try to explain how the shared key become compromised. By mathematical calculation ? By protocol flaw ? Clarify your question before. – Robert NACIRI Mar 30 '15 at 20:59
@RobertNACIRI As I understand it, the only numbers used in ECDH are the two parties public and private keys. I want to know if more than one shared secret can be derived, that way if it is compromised (someone just gets their hands on it) , then a new and different shared secret can be calculated without changing keys. – Melab Mar 31 '15 at 2:52

It sounds like you are thinking of performing static-static Diffie-Hellman. If that is performed naively then it will indeed derive the same secret time and time again. At least one of the key pairs needs to be non-static or ephemeral, or an additional variable (nonce) should be introduced.

For instance in NIST SP 800-56A there is section 6.2.1: "Initiator Has a Static Key Pair and Generates an Ephemeral Key Pair; Responder Has a Static Key Pair, C(1, 2)" for the former and section 6.3: "6.3 Scheme Using No Ephemeral Key Pairs, C(0, 2)" for the latter.

Usually however both key pairs are ephemeral and DH is mainly used for key agreement, relying on another primitive (such as ECDSA or RSA signatures) to add the authentication. If one of the key pairs is newly generated then the resulting keys should be indistinguishable from random (especially if the secret is put through a Key Derivation Function or KDF).

So yes, you have this right, but only for a naive implementation with two static key pairs. The underlying techniques explained above are valid for both Diffie-Hellman (DH) as for Elliptic Curve Diffie-Hellman (ECDH).

share|improve this answer
Just to make sure, I'm talking about elliptic curve Diffie-Hellman. Are the keys used in ECDH ever the same ones found in X.509 certificates or are they generated on the fly and discarded like in any symmetric-key session? – Melab Mar 31 '15 at 2:56
The ideas for ECDH and DH are the same. ECDH has the advantage that it can use the same keys for both ECDH and ECDSA. If ECDH or ECDHE - where the last E is for ephemeral (!) - is used, look at the RFC. I would guess that ECDHE is more common and should be preferred. Note that static-static ECDH can only occur if the client authentication is enabled. – Maarten Bodewes Mar 31 '15 at 6:55
FWIW classic (Z_p) DH can use parameters, and static key values, generated for DSA. But they are encoded differently for X.509 so you can't have one cert usable for both, which you can for ECDH and ECDSA. – dave_thompson_085 Apr 2 '15 at 3:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.