# FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you look, both values of $\sigma$ are made by different values. I can't understand how it's possible that $\sigma_b = \sigma_a$. I need to understand which combination of $d$, $e$, and ephemeral keys are necessary to allow the node to reach the same $\sigma$ value in order to gain the same shared secret key.

• As a concrete example, are you trying to understand how the shared key is derived in Protocol 5 (FHMQV)? There are a lot of protocols in the paper and I wanted to make sure answering this one would answer your question. – user47922 May 31 '17 at 16:25
• yes, it's the protocol 5. – thinker.92 May 31 '17 at 16:34

Both $\hat{A}$ and $\hat{B}$ are computing the same quantity, $G^{xy+bex+yda+adeb}$, letting $\mod q$ be implicit:
$\sigma_{\hat{A}} = (YB^e)^{s_A} = (YB^e)^{x+da} = (G^y G^{be})^{x+da} = G^{xy+yda} G^{bex + beda} = G^{xy+bex+yda+adeb}$
$\sigma_{\hat{B}} = (XA^d)^{y+eb} = (G^x G^{ad})^{y+eb} = G^{xy + xeb} G^{ady + adeb} = G^{xy+bex+yda+adeb} = \sigma_{\hat{A}}$
As for $d$ and $e$, all that matters is that both $\hat{A}$ and $\hat{B}$ can each calculate $d = \bar{H}(X,Y)$ and $e = \bar{H}(Y,X)$. This is true since $\hat{A}$ sends $X$ to $\hat{B}$ and $\hat{B}$ sends $Y$ back to $\hat{A}$.
Note that $\sigma_{\hat{A}} = \sigma_{\hat{B}} = G^{s_A s_B}$, where $s_A = x + da \mod q$ and $s_B = y + eb \mod q$.