Ephemeral Diffie-Hellman in a symmetric crypto context

Question

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?

Answer 1

The key exchange should also be authenticated. $\:$ GCM mode would mostly do that;
however, you should authenticate an indication of which message is for Diffie-Hellman.
(For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data = 0 || application's_associated_data for application-level messages.)