I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key pairs are used to do this, so it would seem that if the shared secret is compromised, then they that particular pair of key sets can't be used again because they would arrive upon the same number as before. Do I have this right?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
It sounds like you are thinking of performing static-static Diffie-Hellman. If that is performed naively then it will indeed derive the same secret time and time again. At least one of the key pairs needs to be non-static or ephemeral, or an additional variable (nonce) should be introduced.
For instance in NIST SP 800-56A there is section 6.2.1: "Initiator Has a Static Key Pair and Generates an Ephemeral Key Pair; Responder Has a Static Key Pair, C(1, 2)" for the former and section 6.3: "6.3 Scheme Using No Ephemeral Key Pairs, C(0, 2)" for the latter.
Usually however both key pairs are ephemeral and DH is mainly used for key agreement, relying on another primitive (such as ECDSA or RSA signatures) to add the authentication. If one of the key pairs is newly generated then the resulting keys should be indistinguishable from random (especially if the secret is put through a Key Derivation Function or KDF).
So yes, you have this right, but only for a naive implementation with two static key pairs. The underlying techniques explained above are valid for both Diffie-Hellman (DH) as for Elliptic Curve Diffie-Hellman (ECDH).