First,i want to show you with a picture how the HMQV works.
There are some notations you might not familiar, it doesn't matter. I just want to show you the procedure.
Next it's an attack on HMQV
Suppose G is the subgroup of Fp* with the order q, q is a prime. And t is an factor of (p-1)/q . G' is another subgroup of Fp* with the order t.
the attack proceeds as follows
adversary M chooses an elemen γ from G' with the order t.
then, M chooses a,x uniformly at random in [1,t-1], calculate A=γa , X=γx ; M impersonates party A to send (hat(A),hat(B), X) to party B.(hat(A) means the identity of party A, so does hat(B))
when party B receives the message, he will compute the shared session key like this K=H((XAd)sB) where sB=y+eb (as in the HMQV)
then, M reveals party B's ephemeral private key y and session key K; Let β=XAd=γx+da, so K=H(βsB)
compute K'=H(βc),where c from 0...t-1, until K=K', so we get sB mod t
My confusion lies in step 5. In party B's view, X ,A and d are just numbers and he doesn't know the order of β — he also won't care about that. He just calculates the result of XAd and then implements K=H(βsB) sB=y+eb (as in the HMQV).
About the form, β=XAd=γx+da, but remember that party B doesn't know the order of γ so, he won't implement the reduction (x+da mod t). Even, he knows the t, he also won't implement the reduction because he does not have x,a. As to sB, party B just treats it as a number, he just calculates the value of βsB. And then hash that value to get K.
So, I think βc≠βsB⇒H(βc)≠H(βsB)⇒K≠K'.
I debated with others on this, but they all think I'm wrong! But as you can see my thought is very reasonable. Where on Earth is their problem? (in other words: What am I missing that they see?)