Is it secure to use Diffie-Hellman key agreement to generate a nonce?

Question

I have a system, using AES, in one of the modes that uses a nonce and authentication.

We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting secret as an IV.

I want to know if there can be any attack on this system: is it possible to perform a man-in-the-middle attack or a replay attack?

Answer 1

Yes, it's secure.

It is somewhat overkill, however, since you could stop replay attacks by using either:

1. a persistent counter as IV, or
2. a random nonce, and including a timestamp in the message.

The AEAD must authenticate the IV (and GCM certainly does), so either would work without requiring any extra round-trips. You can just use the IV in the initial message and have the other party pick it up from there as needed.

---

If you do use Diffie–Hellman, you might as well use the shared secret as a session key instead of a nonce. That way you also get perfect forward secrecy, with ephemeral D–H keys. In that case the initial nonce could just be random, since there's nothing to replay with that key.

And yes, the other answer is correct that Diffie–Hellman is vulnerable to MitM, so you should authenticate the key exchange messages using the long term key.

Answer 2

This algorithm is vulnerable to a Man in the middle. From Wikipedia:

In the original description, the Diffie–Hellman exchange by itself does not provide authentication of the communicating parties and is thus vulnerable to a man-in-the-middle attack. Mallory may establish two distinct key exchanges, one with Alice and the other with Bob, effectively masquerading as Alice to Bob, and vice versa, allowing her to decrypt, then re-encrypt, the messages passed between them. Note that Mallory must continue to be in the middle, transferring messages every time Alice and Bob communicate. If she is ever absent, her previous presence is then revealed to Alice and Bob. They will know that all of their private conversations had been intercepted and decoded by someone in the channel.

A method to authenticate the communicating parties to each other is generally needed to prevent this type of attack. Variants of Diffie–Hellman, such as STS protocol, may be used instead to avoid these types of attacks.

Answer 3

Using Diffie-Hellman key agreement for generating a nonce should be safe as long as both key pairs are ephemeral, i.e. generated for each run of the key agreement protocol. Otherwise a man-in-the-middle can fool one of the parties in generating the same nonce over and over again.

Ephemeral Diffie-Hellman is however overkill for generating a nonce, as the nonce does not have to be secret. So what you can do is to generate a (random) nonce, and send it authenticated with the authentication tag to the other party, together with the initial encrypted message for instance.

To add the IV to the authentication tag, you may have to make it part of the additional authenticated data (AAD). GCM and CCM already include the counter and thus the nonce in the calculation of the tag. I'm presuming an authenticated block cipher with associated data (AEAD) such as GCM here.

Of course, if you have a good source of random numbers and enough bandwidth, you could just create a new (authenticated) nonce for each encrypted message.