I'm working on a project in MCU (micro controller) environment with GPRS connection to exchange data securely with the cloud. The encryption algorithm has been selected to use AES.

I did some search on internet and figured out that ECDH key agreement protocol quite fits the requirements. The good news is that there are some security ICs that have built-in support of ECDH/ECDSA algorithms including secure hardware-based key storage. After digging into this further I learn that ECDH does not do authentication and thus is prone to MITM attacks. This is a very important issue that the system should address.

Can ECDSA be used to do the authentication? Will my system be secure enough with regard to e.g. MITM attacks using a combined ECDH and ECDSA solution?


Saying that ECDH does not do authentication is not entirely accurate. If you use ECDH with static, known public keys and both sides prove knowledge of the shared secret, then you do get authentication. However, with ephemeral keys you need some way to authenticate the exchange of public keys. That could be ECDSA or it could be any other authentication.

So yes, if you use ECDSA to authenticate an ephemeral ECDH key exchange, you avoid man-in-the-middle attacks. You still need some way to trust the ECDSA keys, of course.

  • $\begingroup$ Thanks @otus, I prefer to ephemeral keys solution. It sounds like a recurring issue: introduce ECDSA to authenticate ephemeral ECDH key exchange, now to make sure keys of ECDSA are trusted/authenticated, I need extra 'xxx' to guarantee this? I could mis-understand these as I'm studying crypto stuff. <br/> Another question is can the authentication be done only in the key negotiation stage at the beginning of a session, and don't authenticate all messages communicated after in that specific session? $\endgroup$ – Johnny Shao Sep 29 '15 at 9:42
  • $\begingroup$ The simplest option for trusting ECDSA keys is to pre-share the public keys. If that is not possible you may need PKI which can get complex. Regarding authentication, you only need to use the ECDSA keys to authenticate the ECDH exchange. After that you have symmetric keys you can use for authenticated encryption (e.g. AES GCM). $\endgroup$ – otus Sep 29 '15 at 10:04
  • $\begingroup$ No PKI is not an option in my constrained system. How about HMAC? Would it be a better alternative to ECDSA with pre-shared public keys? $\endgroup$ – Johnny Shao Sep 29 '15 at 10:25
  • $\begingroup$ @JohnnyShao HMAC with a shared key would work as well. Whether it is better depends on how many devices. With just two or so it is simpler, but with ECDSA you only need one key per device regardless of their number. $\endgroup$ – otus Sep 30 '15 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.