2
$\begingroup$

I was reading up on the Triple Diffie-Hellman (3-DH) key exchange and noticed that the wikipedia description [1] is different from the the original protocol definition [2] and the modified definition [3] they reference.

Two users have two key pairs each; $a, A$ and $x, X$ for one user and $b, B$ and $y, Y$ for the other. $H$ is a key derivation function. Is there any difference between the following two shared secrets that can be derived?

  • $K = H(Ay, Xb) = H(Ya, Bx)$
  • $K = H(Yx, Bx, Ya) = H(Xy, Xb, Ay)$

The difference being the addition of the $Yx = Xy$ values to the key derivation.


References:

  1. Wikipedia
  2. Original definition page 15
  3. Modified definition page 560-561
Improve this question
$\endgroup$
2
  • $\begingroup$ The shared secrets from the three DH exchanges (DH1, DH2, DH3) are concatenated in a specific order. The concatenated shared secrets are then input into a key derivation function (KDF), such as HKDF (HMAC-based Key Derivation Function). The KDF takes the concatenated shared secrets and derives a final shared secret key of the desired length. $\endgroup$
    – suchislife
    Commented May 28 at 18:36
  • $\begingroup$ @suchislife I think I understand the algorithm already. Reading this question now, I think I was mostly interested in why the sources differed. Wondering about whether adding the key pairs of the ephemeral keys, $Xy,Yx$, provided any additional security. The keys were already present in the other key pairs, $Ay,Xb,Ya,Bx$, so there must be some reason the ephemeral keys are included again. $\endgroup$
    – n-l-i
    Commented May 28 at 19:19

1 Answer 1

Reset to default
2
$\begingroup$

Rephrasing your question in multiplicative notation:

  • Long term keys are $g^a$ and $g^b$.
  • Ephemeral key exchange is $g^x$ and $g^y$.
  • Compute the session key as either:
    • version 1: $H(g^{ay}, g^{xb})$, or
    • version 2: $H(g^{ay}, g^{xb}, g^{xy})$.

Version 1 has sub-optimal forward secrecy. If an adversary steals the long-term secrets ($a$ and $b$) of both users, then they can compute the session key, even without stealing the ephemeral randomness.

Version 2 makes it harder to break forward secrecy: an adversary must steal both the long-term and ephemeral secrets of some user. This is the best you can hope for, because any key exchange protocol can be broken by stealing long-term and ephemeral secrets from one of the users.

The general intuition is that it's easier to discard ephemeral randomness, whereas long-term secrets obviously need to hang around. So it's preferable to rest security on the difficulty of stealing ephemeral randomness.

You reference this paper:

Kudla and Paterson: Modular Security Proofs for Key Agreement Protocols, Asiacrypt 2005

They do indeed mention this modification, but it is not very prominent (end of section 5):

"We note that Protocol 1 can easily be extended to have perfect forward security by including the value [$g^{xy}$ in our notation] into the computation of the hash function H. This extended Protocol 1 can then be proven secure in an extended mBR model which models perfect forward secrecy."

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.