# Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?

• Does the shared secret have high entropy? – CodesInChaos Jul 15 '15 at 10:08

The key exchange should also be authenticated. $\:$ GCM mode would mostly do that;
(For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data = 0 || application's_associated_data for application-level messages.)