1
$\begingroup$

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?

$\endgroup$
  • $\begingroup$ Does the shared secret have high entropy? $\endgroup$ – CodesInChaos Jul 15 '15 at 10:08
1
$\begingroup$

The key exchange should also be authenticated. $\:$ GCM mode would mostly do that;
however, you should authenticate an indication of which message is for Diffie-Hellman.
(For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data = 0 || application's_associated_data for application-level messages.)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.