1
$\begingroup$

This recent question had me the idea to ask: is there a "misuse-resistant ephemeral key exchange"?

At first sight, this seemed self-contradictary - ephemeral implies there's a random part, while misuse-resistant often implies determinism. But when went through the definitions, this may be workable.

I may be mistaken but this is generally the purpose of an ephemeral key exchange.

An ephemeral key exchange is one in which keying material is generated such that compromise of master key would not lead to disclosure of past exchanges.

So there's 3 questions that can be considered:

  1. Had there been a formal definition of a "misuse-resistant ephemeral key exchange?

  2. Had there been a proposed instance of one?

  3. Would the interface of a misuse-resistant ephemeral key exchange fit with a regular key exchange?

Improve this question
$\endgroup$
5
  • $\begingroup$ Can you provide an example where misuse may occur? I.e. The ability to recover or reuse an ephemeral? $\endgroup$
    – cypherfox
    Commented Mar 25, 2018 at 3:40
  • $\begingroup$ My understanding is that ephemeral KEMs should operate with key-pairs that are randomly generated. The misuse I concern the most with is the failure of RNG. Other misuse may include but not limited to: failure to securely authenticate peer public key, possible side channel, etc. $\endgroup$
    – DannyNiu
    Commented Mar 25, 2018 at 7:06
  • $\begingroup$ If you have a system with poor entropy, you should seed it from a system that has good entropy available. Then use a fast-key-erasure CSPRNG, updating the seed on boot and on clean shutdown. You only need a 32-byte (or 64-byte) seed state that is unique per boot. Any runtime entropy (interrupt timings) can always be mixed in, but so long that the seed is not compromised, this is safe. At no point can you recover historic secrets, only at most (if at all) future secrets with a snapshot of the seed/CSPRNG state. $\endgroup$
    – cypherfox
    Commented Mar 25, 2018 at 7:48
  • $\begingroup$ For ephemerals it is critical that we cannot simply advance a counter, so we need such a CSPRNG. But if you cannot afford the 32-64 byte CSPRNG seed/state, then you'll need to be extra careful with what primitives / functions / protocols you use. $\endgroup$
    – cypherfox
    Commented Mar 25, 2018 at 7:51
  • $\begingroup$ If this were a signature, then a misuse-resistant scheme would require many-time signatures and deterministic, so you don't rely on any additional entropy. But as a handshake, you need entropy and I do not see any way to incorperate misuse-resistance other than by using a CSPRNG instead of bad-entropy. $\endgroup$
    – cypherfox
    Commented Mar 25, 2018 at 7:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.