# How to combine the keys in the Triple Diffie-Hellman (3DH) key exchange?

I was reading up on the Triple Diffie-Hellman (3-DH) key exchange and noticed that the wikipedia description [1] is different from the the original protocol definition [2] and the modified definition [3] they reference.

Two users have two key pairs each; $$a, A$$ and $$x, X$$ for one user and $$b, B$$ and $$y, Y$$ for the other. $$H$$ is a key derivation function. Is there any difference between the following two shared secrets that can be derived?

• $$K = H(Ay, Xb) = H(Ya, Bx)$$
• $$K = H(Yx, Bx, Ya) = H(Xy, Xb, Ay)$$

The difference being the addition of the $$Yx = Xy$$ values to the key derivation.

References:

1. Wikipedia
2. Original definition page 15
3. Modified definition page 560-561
• The shared secrets from the three DH exchanges (DH1, DH2, DH3) are concatenated in a specific order. The concatenated shared secrets are then input into a key derivation function (KDF), such as HKDF (HMAC-based Key Derivation Function). The KDF takes the concatenated shared secrets and derives a final shared secret key of the desired length. Commented May 28 at 18:36
• @suchislife I think I understand the algorithm already. Reading this question now, I think I was mostly interested in why the sources differed. Wondering about whether adding the key pairs of the ephemeral keys, $Xy,Yx$, provided any additional security. The keys were already present in the other key pairs, $Ay,Xb,Ya,Bx$, so there must be some reason the ephemeral keys are included again. Commented May 28 at 19:19

Rephrasing your question in multiplicative notation:

• Long term keys are $$g^a$$ and $$g^b$$.
• Ephemeral key exchange is $$g^x$$ and $$g^y$$.
• Compute the session key as either:
• version 1: $$H(g^{ay}, g^{xb})$$, or
• version 2: $$H(g^{ay}, g^{xb}, g^{xy})$$.

Version 1 has sub-optimal forward secrecy. If an adversary steals the long-term secrets ($$a$$ and $$b$$) of both users, then they can compute the session key, even without stealing the ephemeral randomness.

Version 2 makes it harder to break forward secrecy: an adversary must steal both the long-term and ephemeral secrets of some user. This is the best you can hope for, because any key exchange protocol can be broken by stealing long-term and ephemeral secrets from one of the users.

The general intuition is that it's easier to discard ephemeral randomness, whereas long-term secrets obviously need to hang around. So it's preferable to rest security on the difficulty of stealing ephemeral randomness.

You reference this paper:

Kudla and Paterson: Modular Security Proofs for Key Agreement Protocols, Asiacrypt 2005

They do indeed mention this modification, but it is not very prominent (end of section 5):

"We note that Protocol 1 can easily be extended to have perfect forward security by including the value [$$g^{xy}$$ in our notation] into the computation of the hash function H. This extended Protocol 1 can then be proven secure in an extended mBR model which models perfect forward secrecy."