How do two parties put together the AUTH data in the SKEME protocol?

Question

SKEME is a Key Exchange protocol used in the Internet Key Exchange (IKE). It contains three phases: SHARE, EXCH, and AUTH -- these are defined in Section 3.2 of the linked SKEME document.

I am trying to understand a confusing part (to me at least) about the AUTH phase of SKEME. There is a bit of background to cover before I can get to my actual question, please bear with me...

• SHARE

Phase SHARE is intended to establish a key $K_0$ between $A$ and $B$

In SHARE the parties exchange "half-keys" encrypted under each other's public key and then combine the half-keys via a hash function to produce $K_0$

But this whole phase is skipped if the two parties instead use a Pre-Shared-Key instead of Public Keys. This is defined here:

3.3.2 Pre-shared key and PFS

In this mode, the protocol assumes that the parties already share a secret key, and that they use this key in order to derive a new and fresh key

In this mode of SKEME the SHARE phase can be skipped and the pre-shared key used as $K_0$

This is the mode of SKEME that I am concerned with, so we take it at face value that $A$ and $B$ have Pre-Shared-Key $K_0$

• EXCH

The next phase, EXCH, is used to exchange Diffie-Hellman exponents. Notice that this phase is independent of SHARE.

EXCH:
$A$ --> $B$: $g^x$ $mod$ $p$
$B$ --> $A$: $g^y$ $mod$ $p$

Standard Diffie-Hellman exchange, nothing too complicated here. Both parties now have the DH shared secret.

• AUTH

The authentication of this Diffie-Hellman exchange is accomplished in the following phase, AUTH, which uses the shared key $K_0$ from SHARE to authenticate the Diffie-Hellman exponents.

AUTH:
$A$ --> $B$: $F_{K_0}$ ($g^y$; $g^x$; $id_A$; $id_B$)
$B$ --> $A$: $F_{K_0}$ ($g^x$; $g^y$; $id_B$; $id_A$)

Notice that the key $K_0$ shared in the SHARE phase can be known only to A and B ... The inclusion of $g^x$ in the first message serves to authenticate (to $B$) that $g^x$ came from $A$; the value $g^y$ in the same message is used to prove to $B$ the freshness of this message (assuming $g^y$ was freshly chosen by $B$);

And this is where I get confused.

I know $A$ put calculated $g^x$, and can understand how $A$ knows this value. But from what I understand, $B$ calculated $g^y$, and only shared $g^y$ $mod$ $p$.

Therefore, how does $A$ know $g^y$ to include in the formula above? Similarly, how does $B$ know $g^x$ to calculate the same $F_{K_0}$ to validate the value provided by $A$?

Answer 1

how does $A$ know $g^y$ to include in the formula above?

Actually, what they mean here is, in fact, $g^y \bmod p$; that is, the value that $A$ received. It wouldn't work to insert the literal values $g^x$ and $g^y$; apart from the fact that $A$ doesn't know the second one, there's also the practical difficulty that since $x$ and $y$ are (perhaps) 256 bit random values, the bit representation of $g^x$ and $g^y$ may consist of circa $2^{256}$ bits in length; rather too long to process.

In general, when the group we're working in is understood, we often write $g^y$, with the fact that we're talking about operations in the group, and not as an integer, being implied.