2
$\begingroup$

So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether one could replace the instantiation of the key-exchange with the X3DH primitive*.

So this is my question:
In OPAQUE, can we replace the instatiation of "KE" with the below X3DH primitve?

Or asked differently (but equivalently!) per the requirements in the paper:
Is X3DH AKE-KCI secure (and if not can this be easily fixed)?


*: ie we compute $\operatorname{KE}(x_u,p_u,X_s,P_s)=H(X_s^{x_u}\parallel X_s^{p_u}\parallel P_s^{x_u})$ with the $x$ being ephemeral private / public DH keys and the $p$ being static private / public DH keys.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.