I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy

I am a little bit confused with the described handling of the "r" aes key in the presented DHE (Ephemeral Diffie-Hellman) protocol:

  • DHE is used in asymmetric way : g^x is sent encrypted with r aes key by Bob while g^y is sent in clear form by Alice

  • then r (step 7) is further sent in clear form by Bob so that g^x is recovered by Alice

What may be the rationale for such r aes key use which seems very strange to me ?

  • is g^x to be temporarily hidden to Alice until Bob check that g^y has legal value ?

  • I surely missed the real reason


1 Answer 1


The usage of the r key forces both parties to "fix" the public DH keys.

So Alice doesn't know Bob's public DH key before she's generating her own one.

And Bob can not make the choice of the public key dependant on Alice's choice and vice versa.

This forces both parties to be honest and to generate both public keys at random as there is no opportunity to force a specific derived key that may have some weak properties.

  • $\begingroup$ To SOJPM - Clear; I didn't see or note such kind of DH protection on previous protocols (as TLS or IKE) but it makes full sense. $\endgroup$
    – william_fr
    Apr 14, 2015 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.