So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether one could replace the instantiation of the key-exchange with the X3DH primitive*.

So this is my question:
In OPAQUE, can we replace the instatiation of "KE" with the below X3DH primitve?

Or asked differently (but equivalently!) per the requirements in the paper:
Is X3DH AKE-KCI secure (and if not can this be easily fixed)?

*: ie we compute $\operatorname{KE}(x_u,p_u,X_s,P_s)=H(X_s^{x_u}\parallel X_s^{p_u}\parallel P_s^{x_u})$ with the $x$ being ephemeral private / public DH keys and the $p$ being static private / public DH keys.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.