With magic wormhole, I've discovered SPAKE(2) and I was wondering if it is possible to derive pairwise shared keys between multiple participants still using one password only. More precisely, amongst N participants, each node can broadcast the same handshake value to every other nodes. Reminder for node A and B:

A) x random, X = g^x, sends X* = X * N^pwd

B) y random, Y = g^y, sends Y* = Y * M^pwd (N & M are public and can be the same)

If everyone broadcast the same handshake (X*, Y*, Z*...), and make pair-wise shared key with every other participants (i.e. combining X* and Y*, X* and Z*, etc), is it still secure ? The paper does not say about x being unique, although I might have overlooked.


  • 2
    $\begingroup$ Nitpick: "N & M are public and can be the same" - they certainly seem the same in your question :) $\endgroup$ – Maarten Bodewes Feb 9 '17 at 1:00
  • 2
    $\begingroup$ This really doesn't have anything to do with your question, but one interesting property of spake2 is that it can be backdoored. That is, if someone knows the discrete log of N (that is, the value $z$ s.t. $g^z = N$), then they can perform a dictionary attack from a single exchange, assuming they're the participant who first receives an encrypted message based on the generated secret. Someone who does not know the discrete log cannot do this. Oddly enough, I don't see any warning in the paper that we need to make sure no one knows the relationship of $g, N, M$... $\endgroup$ – poncho Feb 9 '17 at 5:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.