Diffie-Hellman explicit key confirmation

Question

Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure?

1. Alice selects a random $a$ and sends $g^a \mod p$ to Bob

2. Bob selects a random $b$, computes the shared secret $S = (g^a \mod p)^b$

3. Bob computes two keys using HKDF ($H(k, m)$ denotes the HMAC of message $m$ using key $k$):

   • Compute $k = H(salt, S)$
   • Compute $k_1 = H(k, CTX || 0)$ and $k_2 = H(k, CTX || 1)$

4. Bob sends $g^b \mod p$, $H(k_1, k_2)$, the salt, and the string CTX to Alice

5. Alice computes the shared secret $S = (g^b \mod p)^a$, computes $k_1$ and $k_2$ using HKDF given the salt and the string CTX

6. Alice computes $H(k_1, k_2)$ and verifies whether it's the same as the value that she received from Bob.

Answer 1

The major thing missing from Diffie-Hellman is that it provides no protection from someone running a man-in-the-middle attack. Your changes don't actually do anything to prevent that.

That is, suppose Eve was between Alice and Bob; when Alice sends the first message to Bob, Eve intercepts the message, and performs the exchange with Alice. At the same time, Eve forwards her own exchange to Bob. If Alice and Bob were attempting to perform this exchange to create secret keys, well, they will really share keys with Eve; when Alice sends a message, Eve will receive that encrypted message, decrypt it with the key she shares with Alice, examine it, and then encrypt it with the key she shares with Bob, and forwards it. That way, Eve sees all the traffic between Alice and Bob without being aware of it.

There is nothing that this key confirmation does that makes this any more difficult for Eve; she can compute $H(k_1, k_2)$ just as well as Alice and Bob, and so she will be able to impersonate Bob to Alice (and impersonating Alice to Bob).

Now, if the question was "is it secure if we don't have to worry about man-in-the-middle", the answer is "well, straight Diffie-Hellman is secure in that scenario; your additions don't appear to have made anything worse".