Difference entity authentication and implicit key authentication

Question

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions:

• Implicit key authentication is when one party is assured that no other aside from a specifically identified second party has the possibility to determine the secret key (§12.2.1).

• Entity authentication is when one is corroborated of the identity of another party, and of the fact that this party is alive (active) during the protocol (§10.1).

Somewhat further (§12.6) it is stated that MTI/A0 provides mutual key authentication without key confirmation or entity authentication.

This made me wonder what the difference could be between entity authentication and implicit key authentication aside from the alivelinees property. I see the "specifically identified second party" and "corroborated of the identity of another party" as the same thing. Is this correct or do I interpret things wrong?

Answer 1

In entity authentication, the parties do not necessarily exchange a session key, but authenticate to each other by providing some proof related to their identites. For instance, if one party signs a challenge given by its partner, this party proves its identity.

Implicit key authentication merely guarantees that the partner (with whom you are talking right now, but who could be unidentified) is holding the same key, and no one else is.

Example:

• A chooses random $x$ and sends $g^x$ to B.
• B chooses random $y$ and sends $g^y$ to A.

Only A and B can know $g^{ab}$, but they do not authenticate to each other. Hence, the protocol provides implicit key authentication but no entity authentication. The above protocol is actually not secure against man-in-the-middle attacks; it merely serves as an separation example.