I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you look, both values of $\sigma$ are made by different values. I can't understand how it's possible that $\sigma_b = \sigma_a$. I need to understand which combination of $d$, $e$, and ephemeral keys are necessary to allow the node to reach the same $\sigma$ value in order to gain the same shared secret key.

  • 1
    $\begingroup$ As a concrete example, are you trying to understand how the shared key is derived in Protocol 5 (FHMQV)? There are a lot of protocols in the paper and I wanted to make sure answering this one would answer your question. $\endgroup$ – user47922 May 31 '17 at 16:25
  • $\begingroup$ yes, it's the protocol 5. $\endgroup$ – thinker.92 May 31 '17 at 16:34

Both $\hat{A}$ and $\hat{B}$ are computing the same quantity, $G^{xy+bex+yda+adeb}$, letting $\mod q$ be implicit:

$\sigma_{\hat{A}} = (YB^e)^{s_A} = (YB^e)^{x+da} = (G^y G^{be})^{x+da} = G^{xy+yda} G^{bex + beda} = G^{xy+bex+yda+adeb}$

$\sigma_{\hat{B}} = (XA^d)^{y+eb} = (G^x G^{ad})^{y+eb} = G^{xy + xeb} G^{ady + adeb} = G^{xy+bex+yda+adeb} = \sigma_{\hat{A}}$

As for $d$ and $e$, all that matters is that both $\hat{A}$ and $\hat{B}$ can each calculate $d = \bar{H}(X,Y)$ and $e = \bar{H}(Y,X)$. This is true since $\hat{A}$ sends $X$ to $\hat{B}$ and $\hat{B}$ sends $Y$ back to $\hat{A}$.

Note that $\sigma_{\hat{A}} = \sigma_{\hat{B}} = G^{s_A s_B}$, where $s_A = x + da \mod q$ and $s_B = y + eb \mod q$.

| improve this answer | |
  • $\begingroup$ Ok, only one question. I'm trying to implement this protocol and I need to know if I've to translate the exponentiation into multiplication and multiplication into addiction( e.g the sigma calculation would be: σa=[ Y + ( B * e) ] * sa and σb=[ X + ( A * e) ] * sb.) Is it right ? $\endgroup$ – thinker.92 May 31 '17 at 22:44
  • 1
    $\begingroup$ Are you trying to do an elliptic-curve version of this? That looks right, but you should be careful to translate everything over to ECC, like verifying that X and Y are actually points on whatever curve you use. See here for some details on that. $\endgroup$ – user47922 May 31 '17 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.