I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key pairs are used to do this, so it would seem that if the shared secret is compromised, then they that particular pair of key sets can't be used again because they would arrive upon the same number as before. Do I have this right?

  • $\begingroup$ This is the same problem for any key exchange protocol. If the shared key is compromised, then Alice and Bob can't communicate secrectly. ECDH is the EC version of DH exchange protocol, and is based on the intractability of DLP. Try to explain how the shared key become compromised. By mathematical calculation ? By protocol flaw ? Clarify your question before. $\endgroup$ – Robert NACIRI Mar 30 '15 at 20:59
  • $\begingroup$ @RobertNACIRI As I understand it, the only numbers used in ECDH are the two parties public and private keys. I want to know if more than one shared secret can be derived, that way if it is compromised (someone just gets their hands on it) , then a new and different shared secret can be calculated without changing keys. $\endgroup$ – Melab Mar 31 '15 at 2:52

It sounds like you are thinking of performing static-static Diffie-Hellman. If that is performed naively then it will indeed derive the same secret time and time again. At least one of the key pairs needs to be non-static or ephemeral, or an additional variable (nonce) should be introduced.

For instance in NIST SP 800-56A there is section 6.2.1: "Initiator Has a Static Key Pair and Generates an Ephemeral Key Pair; Responder Has a Static Key Pair, C(1, 2)" for the former and section 6.3: "6.3 Scheme Using No Ephemeral Key Pairs, C(0, 2)" for the latter.

Usually however both key pairs are ephemeral and DH is mainly used for key agreement, relying on another primitive (such as ECDSA or RSA signatures) to add the authentication. If one of the key pairs is newly generated then the resulting keys should be indistinguishable from random (especially if the secret is put through a Key Derivation Function or KDF).

So yes, you have this right, but only for a naive implementation with two static key pairs. The underlying techniques explained above are valid for both Diffie-Hellman (DH) as for Elliptic Curve Diffie-Hellman (ECDH).

  • $\begingroup$ Just to make sure, I'm talking about elliptic curve Diffie-Hellman. Are the keys used in ECDH ever the same ones found in X.509 certificates or are they generated on the fly and discarded like in any symmetric-key session? $\endgroup$ – Melab Mar 31 '15 at 2:56
  • $\begingroup$ The ideas for ECDH and DH are the same. ECDH has the advantage that it can use the same keys for both ECDH and ECDSA. If ECDH or ECDHE - where the last E is for ephemeral (!) - is used, look at the RFC. I would guess that ECDHE is more common and should be preferred. Note that static-static ECDH can only occur if the client authentication is enabled. $\endgroup$ – Maarten Bodewes Mar 31 '15 at 6:55
  • 1
    $\begingroup$ FWIW classic (Z_p) DH can use parameters, and static key values, generated for DSA. But they are encoded differently for X.509 so you can't have one cert usable for both, which you can for ECDH and ECDSA. $\endgroup$ – dave_thompson_085 Apr 2 '15 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.