As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.
What are the differences between these two types?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those keys are trusted keys: the public keys are commonly embedded in signed certificates. That way static-static Diffie-Hellman can be not just used to derive a secret (session) key, but also to authenticate both parties. You can do this by e.g. verifying a MAC value over known data or a challenge, calculated using a secret key derived from the shared secret.
Note that it is required to use a nonce generated by (at least) one of the parties for static-static Diffie-Hellman: without this nonce the derived secret would always be the same, as there is no fresh data within the Diffie-Hellman calculation itself.
Static-static Diffie-Hellman is not used to provide forward secrecy: if either one of the private keys is found by an adversary then the shared secret can be calculated (using the public key of the other party) and all security is lost.
With ephemeral-static Diffie-Helman one party generates a new key pair for each key agreement.
Only the party with the static key pair can be authenticated by the key agreement itself. The other party with the ephemeral (transient or fleeting) key pair can authenticate itself after the key agreement. As it knows now that the session is to a trusted party, that authentication could be anything from signature generation to simple password validation over a secure channel.
Ephemeral-static Diffie-Hellman also does not provide forward secrecy. If the static private key is found by an adversary then the shared secret can still be calculated for this and every other connection that was created by it. Of course the private key may be destroyed at the party holding the ephemeral key pair, which may still provide some security benefit.
Generally ephemeral-ephemeral Diffie-Hellman is used. This provides forward secrecy: the other sessions are still secure even if one or both of the private keys is found. Both key pairs are regenerated for each key agreement. Fortunately, DH key pair generation is nowhere as slow as RSA key pair generation. RSA or ECDSA can be used to authenticate one or both the parties. TLS 1.3 for instance requires ephemeral-ephemeral DH during the (initial) handshake.
Note that it is also possible to encapsulate a secret key using a Key Encapsulation Method or KEM. For instance, ephemeral RSA-KEM could be used to derive the same key value at both sides. This uses encapsulation at one side and decapsulation / extraction on the other side holding the private key, after which the private key could be destroyed. However, in the case of RSA the time it takes to generate a new key pair could be problematic.
All of the above goes for both Diffie-Hellman using a multiplicative group (just DH) as well as ECDH. More info can be found in the document NIST Special Publication 800-56A, Revision 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography. Take a look at the C(0e, 2s) for the static-static and C(1e, 1s) for the ephemeral-static scheme.