# How secure is ECDH if the public keys are never changed?

I have a scenario where I'd like to use Diffie Hellman keys where the public keys are exchanged once and then never changed.

So server generates a key pair (secp256k1 or secp256r1) and sends its public key to client and the client does the same. From that point onward, all the communication is secured by using the derived symmetric key. But these key pairs are never changed.

My question is how secured is how easy would it be for someone to figure out the symmetric key now that the same key is used for encryption/decryption?

• Is there some sort of standard you are following for this? Or can you write out the mathematics of what you are proposing? Also, how is the symmetric key used? Do you have a mode of encryption in mind? Reusing the same symmetric key over a long period of time is never a good idea. – mikeazo Mar 22 '18 at 12:15
• NIST SP 56A: Revision 2, May 2013 chapter 6.3 specifies static-static Diffie-Hellman schemes, if you need that. It uses a nonce in addition to the public keys to make sure that the shared secret changes value after each key agreement. – Maarten Bodewes Mar 22 '18 at 13:16

## 1 Answer

How secure is ECDH if the public keys are never changed?

The following notation of $Gba$ is the $\operatorname{diffie-hellman(Gb, a)}$ or ${g^b}^a$ where we assume Alice' perspective where Alice knows $a$ and $Gb$, not $b$. Bob computes the equivilent $Gab$.

I advise against using straight static-dh where $a$ and $b$ are static and $k$ is unique per pair of users.

$$k = \operatorname{kdf}(Gba)$$

If either key is compromised then a passive adversary who records transactions may recover all messages. Worse, an active adversary may silently MiTM all sessions in real-time.

The full MiTM requires impersonating both sides, which KCI (key compromise impersonation) enables. I.e. If Mallory knows $a$, she can pretend to be Alice to Bob and pretend to be Bob to Alice.

One popular alternative is 3DH, as used in Signal and similar protocols.

$$k = \operatorname{kdf}(Gda \| Gbc \| Gdc)$$

Where $c$ is Alice' ephemeral key and $d$ is Bob's ephemeral key. Notice $Gab$ is not used because it is static and does not introduce additional security as the ephemerals are paired with the static keys providing KCI-resistant mutual authentication and paired together for forward secrecy.

If both of Alice and Bob's keys are compromised. A passive adversary is still unable to recover messages. However, an active adversary may substitute the ephemerals and do the full MiTM again.

If the client is anonymous, you may use 2DH by omitting $a$ and computing instead:

$$k = \operatorname{kdf}(Gbc \| Gdc)$$

My question is how secured is how easy would it be for someone to figure out the symmetric key now that the same key is used for encryption/decryption?

You must always respect the security contract of any function you use. I.e. Never reuse a $k$ with a single-use AE. Never reuse a $(k,n)$ tuple with an nAE.

If you're using the symmetric key correctly or not is irrelevant to how the key was derived.

Edit: If you're asking if it is safe to shake hands with with many people? Then yes, so long that the construction is safely guarding against bad-keyshare attacks, the result should not reveal anything to an adversary, even if you shake hands directly with them.

• YM (g^b)^a or g^(ba) (equal to g^(ab)) not g^(b^a) – dave_thompson_085 Mar 23 '18 at 0:56