Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions:

  • Implicit key authentication is when one party is assured that no other aside from a specifically identified second party has the possibility to determine the secret key (§12.2.1).

  • Entity authentication is when one is corroborated of the identity of another party, and of the fact that this party is alive (active) during the protocol (§10.1).

Somewhat further (§12.6) it is stated that MTI/A0 provides mutual key authentication without key confirmation or entity authentication.

This made me wonder what the difference could be between entity authentication and implicit key authentication aside from the alivelinees property. I see the "specifically identified second party" and "corroborated of the identity of another party" as the same thing. Is this correct or do I interpret things wrong?

share|improve this question
up vote 3 down vote accepted

In entity authentication, the parties do not necessarily exchange a session key, but authenticate to each other by providing some proof related to their identites. For instance, if one party signs a challenge given by its partner, this party proves its identity.

Implicit key authentication merely guarantees that the partner (with whom you are talking right now, but who could be unidentified) is holding the same key, and no one else is.


  • A chooses random $x$ and sends $g^x$ to B.
  • B chooses random $y$ and sends $g^y$ to A.

Only A and B can know $g^{ab}$, but they do not authenticate to each other. Hence, the protocol provides implicit key authentication but no entity authentication. The above protocol is actually not secure against man-in-the-middle attacks; it merely serves as an separation example.

share|improve this answer
That is not the notation as used in the quoted example in the question, where the second party is "specifically identified". – Paŭlo Ebermann Jun 13 '13 at 5:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.