# Diffie-Hellman explicit key confirmation

Suppose I wanted to add explicit key confirmation to Diffie-Hellman key exchange, would the following scheme be secure?

1. Alice selects a random $a$ and sends $g^a \mod p$ to Bob

2. Bob selects a random $b$, computes the shared secret $S = (g^a \mod p)^b$

3. Bob computes two keys using HKDF ($H(k, m)$ denotes the HMAC of message $m$ using key $k$):

• Compute $k = H(salt, S)$
• Compute $k_1 = H(k, CTX || 0)$ and $k_2 = H(k, CTX || 1)$
4. Bob sends $g^b \mod p$, $H(k_1, k_2)$, the salt, and the string CTX to Alice

5. Alice computes the shared secret $S = (g^b \mod p)^a$, computes $k_1$ and $k_2$ using HKDF given the salt and the string CTX

6. Alice computes $H(k_1, k_2)$ and verifies whether it's the same as the value that she received from Bob.

There is nothing that this key confirmation does that makes this any more difficult for Eve; she can compute $H(k_1, k_2)$ just as well as Alice and Bob, and so she will be able to impersonate Bob to Alice (and impersonating Alice to Bob).
• @herrfz: The sole additional information you're providing an evesdropper is $H(k_1, k_2)$; given that the only way to attack that is either to brute force it, or to have a Rainbow table, and the shared secret $S$ is too large for either; this doesn't give an evesdropper any additional edge. Feb 7, 2014 at 16:47