1
$\begingroup$

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?

Improve this question
$\endgroup$
1
  • $\begingroup$ Does the shared secret have high entropy? $\endgroup$
    – CodesInChaos
    Jul 15, 2015 at 10:08

1 Answer 1

Reset to default
1
$\begingroup$

The key exchange should also be authenticated. $\:$ GCM mode would mostly do that;
however, you should authenticate an indication of which message is for Diffie-Hellman.
(For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data = 0 || application's_associated_data for application-level messages.)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.