# How to perform Black box testing of a key exchange protocol?

Though obviously not an alternative for proper cryptanalysis, I was wondering about statistical/black box analysis. Should I produce a new key exchange protocol. With the same shape as Diffie-Hellman:

Each side picks a random number $r_i$, calculates $f(r_i)$ sends it and receives $f(r_{1-i})$ then calculate a shared key $g(f(r_{1-i}),r_i)$ = $g(f(r_i),r_{1-i})$

Obviously for the key exchange to be secure $f$ needs to be one way, I'm aware of NIST tests for PRNGs I assume they could be used to evaluate a one way function. Though obviously showing $f$ is a one way function isn't sufficient, what more can be tested empirically? Are there any existing sets of tests you can run?

• You can only check (but not prove) that the algorithm is correct by performing some black box tests. But you can never show that the algorithm is secure by testing. – user27950 Mar 11 '18 at 18:49
• Well yeah, that's the first sentence in my question. – Meir Maor Mar 11 '18 at 20:02
• Your first sentence implies that testing makes sense. My statement says that testing makes no sense. – user27950 Mar 11 '18 at 20:25
• I assert it does make sense, testing is easy and necessary. It is common practice to apply statistical tests as a sniff test, like the NIST tests for RNGs. And problematic properties which appear in statistical tests are later discussed deeply, for example the Solliter cipher has a known bias in it. I argue black box testing though insufficient it is not only useful but even necessary. – Meir Maor Mar 11 '18 at 21:00