# Why does spiped use both nonces and ephemeral keys?

Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy. The protocol is summarized in the project's README under the section "Encrypted Protocol".

What is the purpose of the nonces (nonce_C and nonce_S)? How are they useful when x_C and x_S are already chosen at random?

Without the nonces, one could violate explicit authentication
by replaying the group_element || MAC_tag messages.

• Can you elaborate on the replay attack? I don't see how the attacker could actually replay packets, since the other party will end up computing a different shared secret every time. – Tim McLean May 7 '15 at 2:55
• The attacker would just send the same group_element || MAC_tag to the party that message $\hspace{.26 in}$ was sent to before, even though that "party will end up computing a different shared secret every time." $\hspace{.15 in}$ – user991 May 7 '15 at 3:06
• Right. So the receiver accepts group_element as valid, and computes a new y_SC (a new shared secret). The receiver then derives the new AES and HMAC keys. How does the attacker now produce a packet with a valid HMAC tag? The attacker can't simply replay packets because the HMAC key has changed, AFAICT. – Tim McLean May 7 '15 at 3:14
• The attacker doesn't "now produce a packet with a valid HMAC tag". $\;$ – user991 May 7 '15 at 3:23
• Yes. ${}{}{}\;$ – user991 May 7 '15 at 3:29

Without the initial exchange of nonces, an attacker could replay a recorded handshake. Although an attacker can't use this to replay actual packets, an attacker could possibly execute a denial of service attack if the process protected by spiped is not expecting a large number of connections.

The attack (assuming a modified spiped protocol that MACs the public keys directly with the long-term key):

1. Observe a handshake. Record y_C || h_C, where y_C is the client's ephemeral public key and h_C = HMAC(K, y_C) (K is the pre-shared key).
2. Open a new connection and replay y_C || h_C. The server sees a valid MAC, and presumably opens a connection to the protected process.
3. Repeat #2 until the protected process is overwhelmed.

Thanks to Ricky Demer for the discussion on his answer.