I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other people can also derive secrets $d_1*Q$ and $d_2*Q$. Assuming all key pairs were generated from the same elliptic curve, is it safe to use both the shared secrets in the same session for 2-way communication?

  • $\begingroup$ what does it mean by "derive 2 shared secrets , $d*Q_1$ ..." ? . Also looks like some text book problem ? $\endgroup$ – sashank Jun 12 '15 at 3:09
  • $\begingroup$ It's very much a real world problem. What I mean by 2 shared secrets is using the same private key, pairing it with 2 different public keys (all from the same curve) to generate 2 shared secrets using Diffie-Hellman. (The shared secrets will be $d*Q_1$ and $d*Q_2$ on one side and $d_1*Q$ and $d_2*Q$ on the other side.) Keep in mind that both shared secrets are being used at the same time(To generate symmetric keys for example). $\endgroup$ – user25016 Jun 12 '15 at 9:45

Yes, you can use a (semi) static key pair for (Elliptic Curve) Diffie-Hellman. If you want to check for sure that you use ECDH correctly take a look at the NIST SP 56A which shows the various way that key agreement can be used. In this case you'd probably look for

Note that you should check the public keys for validity. Furthermore, this describes a key agreement protocol. If the static public key can be trusted by the two other parties then the party holding the static key pair has been authenticated. You may require additional authentication for the other two parties. Finally, you probably want to use a MAC to validate that you've both generated the correct secret keys in your key agreement protocol rather than afterwards. This probably means that you need a KDF to derive the various session keys. You may want to use different keys for each direction of communication as well.

| improve this answer | |
  • $\begingroup$ Note that I've given a relatively generic answer; with the limited information given I cannot say for sure that your protocol is secure or not. $\endgroup$ – Maarten Bodewes Jun 12 '15 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy