SKEME is a Key Exchange protocol used in the Internet Key Exchange (IKE). It contains three phases: SHARE, EXCH, and AUTH -- these are defined in Section 3.2 of the linked SKEME document.

I am trying to understand a confusing part (to me at least) about the AUTH phase of SKEME. There is a bit of background to cover before I can get to my actual question, please bear with me...


Phase SHARE is intended to establish a key $K_0$ between $A$ and $B$

In SHARE the parties exchange "half-keys" encrypted under each other's public key and then combine the half-keys via a hash function to produce $K_0$

But this whole phase is skipped if the two parties instead use a Pre-Shared-Key instead of Public Keys. This is defined here:

3.3.2 Pre-shared key and PFS

In this mode, the protocol assumes that the parties already share a secret key, and that they use this key in order to derive a new and fresh key

In this mode of SKEME the SHARE phase can be skipped and the pre-shared key used as $K_0$

This is the mode of SKEME that I am concerned with, so we take it at face value that $A$ and $B$ have Pre-Shared-Key $K_0$

  • EXCH

The next phase, EXCH, is used to exchange Diffie-Hellman exponents. Notice that this phase is independent of SHARE.

$A$ --> $B$: $g^x$ $mod$ $p$
$B$ --> $A$: $g^y$ $mod$ $p$

Standard Diffie-Hellman exchange, nothing too complicated here. Both parties now have the DH shared secret.

  • AUTH

The authentication of this Diffie-Hellman exchange is accomplished in the following phase, AUTH, which uses the shared key $K_0$ from SHARE to authenticate the Diffie-Hellman exponents.

$A$ --> $B$: $F_{K_0}$ ($g^y$; $g^x$; $id_A$; $id_B$)
$B$ --> $A$: $F_{K_0}$ ($g^x$; $g^y$; $id_B$; $id_A$)

Notice that the key $K_0$ shared in the SHARE phase can be known only to A and B ... The inclusion of $g^x$ in the first message serves to authenticate (to $B$) that $g^x$ came from $A$; the value $g^y$ in the same message is used to prove to $B$ the freshness of this message (assuming $g^y$ was freshly chosen by $B$);

And this is where I get confused.

I know $A$ put calculated $g^x$, and can understand how $A$ knows this value. But from what I understand, $B$ calculated $g^y$, and only shared $g^y$ $mod$ $p$.

Therefore, how does $A$ know $g^y$ to include in the formula above? Similarly, how does $B$ know $g^x$ to calculate the same $F_{K_0}$ to validate the value provided by $A$?


1 Answer 1


how does $A$ know $g^y$ to include in the formula above?

Actually, what they mean here is, in fact, $g^y \bmod p$; that is, the value that $A$ received. It wouldn't work to insert the literal values $g^x$ and $g^y$; apart from the fact that $A$ doesn't know the second one, there's also the practical difficulty that since $x$ and $y$ are (perhaps) 256 bit random values, the bit representation of $g^x$ and $g^y$ may consist of circa $2^{256}$ bits in length; rather too long to process.

In general, when the group we're working in is understood, we often write $g^y$, with the fact that we're talking about operations in the group, and not as an integer, being implied.

  • $\begingroup$ Perfect, thanks Poncho, sorry the check mark took a while to deliver! $\endgroup$
    – Eddie
    Jun 1, 2016 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.