As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.

What are the differences between these two types?


Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those keys are trusted keys: the public keys are commonly embedded in signed certificates. That way static-static Diffie-Hellman can be not just used to derive a secret (session) key, but also to authenticate both parties.

Note that it is required to use a nonce generated by (at least) one of the parties for static-static Diffie-Hellman: without this nonce the derived secret would always be the same, as there is no fresh data within the Diffie-Hellman calculation itself.

Static-static Diffie-Hellman is not provide forward secrecy: if either one of the private keys is found by an adversary then the shared secret can be calculated (using the public key of the other party) and all security is lost.

With ephemeral-static Diffie-Helman one party generates a new key pair for each key agreement.

Only the party with the static key pair can be authenticated by the key agreement itself. The other party with the ephemeral (transient or fleeting) key pair can authenticate itself after the key agreement. As it knows now that the session is to a trusted party, that authentication could be anything from signature generation to simple password validation over a secure channel.

Ephemeral-static Diffie-Hellman is does not provide forward secrecy. If the static private key is found by an adversary then the shared secret can still be calculated for this and every other connection that was created by it.

Generally ephemeral-ephemeral Diffie-Hellman is used. This provides forward secrecy: the other sessions are still secure even if one or both of the private keys is found. Both key pairs are regenerated for each key agreement. Fortunately, DH key pair generation is nowhere as slow as RSA key pair generation. RSA or ECDSA can be used to authenticate one or both the parties.

All of the above goes for both Diffie-Hellman using a multiplicative group (just DH) as well as ECDH. More info can be found in the document NIST Special Publication 800-56A, Revision 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography. Take a look at the C(0e, 2s) for the static-static and C(1e, 1s) for the ephemeral-static scheme.

  • $\begingroup$ Why do I need to a use a nonce generated by (at least) one of the parties for static-static? the secret key is fixed, is not it? $\endgroup$ – Aymn Alaney Aug 26 '18 at 0:40
  • $\begingroup$ Well, generally you do key agreement to create a new key. I mean, otherwise you could just do it once and continue with the key after (possibly after a challenge / return). But generally modes of operation have a maximum number of times you can reuse a key, and you have to reuse the key correctly (wrt to the IV, for instance). $\endgroup$ – Maarten Bodewes Aug 26 '18 at 2:52

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.