Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Asuming this scenario:

Bob and Alice each have the public key of the other party for a D-H function and want to exchange data.

Now, if they each generate their shared secret, is it safe to assume that:

  • They can exchange messages safely without the fear of a MITM
  • Can reuse the shared secret n times

And what would be a estimated count for how many messages may be exchanged before the need for new public and private keys arises?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

If Alice and Bob both use static DH keys, they only have to perform the DH operation once to get their shared secret. The number of messages that are safe to exchange encrypted with something derived from that shared secret is not really a function of the DH problem, except to the extent that the size of the modulus and of the private keys put a limit on the maximum security strength of the shared secret.

However, there are other factors that might entail such a limit, such as whether or not they exchange nonces for the key derivation from the (calculated once) shared secret, which symmetric cipher they use for bulk encryption, which mode of operation is used, etc.

Another thing that might entail such a limit is their confidence in the key management of both Alice's and Bob's private key. If either private key is compromised, this will mean complete loss of confidentiality of all messages sent encrypted with a key derived from a shared secret calculated using that key. Again, this is a key management issue and not a security issue specific to static DH in any way, but it might be mentioned as the reason why there exist various hybrid schemes that mix long term asymmetric keys with ephemeral asymmetric keys.

share|improve this answer
1  
Indeed. Thus yes, Alice and Bob can exchange messages safely without fear of a MITM; yes they can reuse the shared secret multiple times; how many times does not depend on the DH key exchange, but on how the shared secret is used in a later (probably symmetric) part of the protocol. –  fgrieu Sep 24 '12 at 11:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.