1
$\begingroup$

For example in my course there is this protocol :

Initialisation: A and B are sharing a symmetric key S.
(1) A -> B: Ra ; A generates a random number and sends it to A
(2) A <- B: Rb ; B does the same
A and B computes the session key K := E_S(Ra XOR Rb).

Why A and B would establish a new key K if they already have the key S ?
I don't get it.

For me, the Diffie-Hellman protocol is coherent because it establishes a key between 2 entities that have never talked before.

$\endgroup$
4
$\begingroup$

Hint

Consider what would happen if an adversary somehow managed to recover the session key.

Spoiler

If they simply used the shared key as the session key directly, then an adversary who compromises the key can then compromise all future communications.

If they derive the session key using the shared key, then an adversary who compromises the session key only compromises the current session.

Why not just use DH?

There are plenty of reasons - the first is probably to demonstrate the point above.

Secondly, DH is more computationally expensive then the pre-shared key technique.

  • Some real world protocols do in fact offer the ability to secure a communications channel via pre-shared keys.
  • A constrained device may not be able to afford the circuit size/power/time/bandwidth to use DH
| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.