Asuming this scenario:

Bob and Alice each have the public key of the other party for a D-H function and want to exchange data.

Now, if they each generate their shared secret, is it safe to assume that:

  • They can exchange messages safely without the fear of a MITM
  • Can reuse the shared secret n times

And what would be a estimated count for how many messages may be exchanged before the need for new public and private keys arises?


1 Answer 1


If Alice and Bob both use static DH keys, they only have to perform the DH operation once to get their shared secret. The number of messages that are safe to exchange encrypted with something derived from that shared secret is not really a function of the DH problem, except to the extent that the size of the modulus and of the private keys put a limit on the maximum security strength of the shared secret.

However, there are other factors that might entail such a limit, such as whether or not they exchange nonces for the key derivation from the (calculated once) shared secret, which symmetric cipher they use for bulk encryption, which mode of operation is used, etc.

Another thing that might entail such a limit is their confidence in the key management of both Alice's and Bob's private key. If either private key is compromised, this will mean complete loss of confidentiality of all messages sent encrypted with a key derived from a shared secret calculated using that key. Again, this is a key management issue and not a security issue specific to static DH in any way, but it might be mentioned as the reason why there exist various hybrid schemes that mix long term asymmetric keys with ephemeral asymmetric keys.

  • 1
    $\begingroup$ Indeed. Thus yes, Alice and Bob can exchange messages safely without fear of a MITM; yes they can reuse the shared secret multiple times; how many times does not depend on the DH key exchange, but on how the shared secret is used in a later (probably symmetric) part of the protocol. $\endgroup$
    – fgrieu
    Commented Sep 24, 2012 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.