0
$\begingroup$

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs.

1st paragraph: I want to understand how the DH function is working? How is it calculating the shared secret key using public keys?

DH(PK1, PK2) represents a byte sequence which is the shared secret output from an Elliptic Curve Diffie-Hellman function involving the key pairs represented by public keys PK1 and PK2. The Elliptic Curve Diffie-Hellman function will be either the X25519 or X448 function from [1], depending on the curve parameter.

2nd paragraph: In the first point $F$ is used to identify the type of curve, right? What is the secret key material here? What is the use of HKDF info?

KDF(KM) represents 32 bytes of output from the HKDF algorithm [3] with inputs:

1) HKDF input key material = F || KM, where KM is an input byte sequence containing secret key material, and F is a byte sequence containing 32 0xFF bytes if curve is X25519, and 57 0xFF bytes if curve is X448. F is used for cryptographic domain separation with XEdDSA [2].

2) HKDF salt = A zero-filled byte sequence with length equal to the hash output length.

3) HKDF info = The info parameter from Section 2.1.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$
  1. The $DH(PK_1, PK_2)$ function is doing the usual elliptic curve Diffie-Hellman algorithm. The secret keys involved are implicit here; of course you cannot compute the shared secret key without them! Notice that they omit the explicit use of the secret key in the $Sig(PK,M)$ function even though it too requires a secret key.
  2. Yes, the $F$ value is used for domain separation. The input key material is the shared secret key from the ECDH function. Part of the point of an HKDF is to make the output key material appropriately pseudorandom for cryptographic use, and the ECDH shared secret needs this transformation. Finally, the HKDF info allows you to generate multiple keys with the same key material; see the comments here for more.
Improve this answer
$\endgroup$
2
  • $\begingroup$ can you please also explain the use of HKDF salt (zero-filled byte sequence) ? $\endgroup$
    – tarun14110
    Commented May 27, 2017 at 12:18
  • $\begingroup$ The inputs to the HKDF are key material, salt (optional) and info (optional). When a salt value isn't provided, a default value is used, namely a byte sequence of zeros. For X3DH it seems that the byte sequence must be the default value. $\endgroup$
    – user47922
    Commented May 27, 2017 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.