As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.

What are the differences between these two types?


1 Answer 1


Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those keys are trusted keys: the public keys are commonly embedded in signed certificates. That way static-static Diffie-Hellman can be not just used to derive a secret (session) key, but also to authenticate both parties. You can do this by e.g. verifying a MAC value over known data or a challenge, calculated using a secret key derived from the shared secret.

Note that it is required to use a nonce generated by (at least) one of the parties for static-static Diffie-Hellman: without this nonce the derived secret would always be the same, as there is no fresh data within the Diffie-Hellman calculation itself.

Static-static Diffie-Hellman is not used to provide forward secrecy: if either one of the private keys is found by an adversary then the shared secret can be calculated (using the public key of the other party) and all security is lost.

With ephemeral-static Diffie-Helman one party generates a new key pair for each key agreement.

Only the party with the static key pair can be authenticated by the key agreement itself. The other party with the ephemeral (transient or fleeting) key pair can authenticate itself after the key agreement. As it knows now that the session is to a trusted party, that authentication could be anything from signature generation to simple password validation over a secure channel.

Ephemeral-static Diffie-Hellman also does not provide forward secrecy. If the static private key is found by an adversary then the shared secret can still be calculated for this and every other connection that was created by it. Of course the private key may be destroyed at the party holding the ephemeral key pair, which may still provide some security benefit.

Generally ephemeral-ephemeral Diffie-Hellman is used. This provides forward secrecy: the other sessions are still secure even if one or both of the private keys is found. Both key pairs are regenerated for each key agreement. Fortunately, DH key pair generation is nowhere as slow as RSA key pair generation. RSA or ECDSA can be used to authenticate one or both the parties. TLS 1.3 for instance requires ephemeral-ephemeral DH during the (initial) handshake.

Note that it is also possible to encapsulate a secret key using a Key Encapsulation Method or KEM. For instance, ephemeral RSA-KEM could be used to derive the same key value at both sides. This uses encapsulation at one side and decapsulation / extraction on the other side holding the private key, after which the private key could be destroyed. However, in the case of RSA the time it takes to generate a new key pair could be problematic.

All of the above goes for both Diffie-Hellman using a multiplicative group (just DH) as well as ECDH. More info can be found in the document NIST Special Publication 800-56A, Revision 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography. Take a look at the C(0e, 2s) for the static-static and C(1e, 1s) for the ephemeral-static scheme.

  • $\begingroup$ Why do I need to a use a nonce generated by (at least) one of the parties for static-static? the secret key is fixed, is not it? $\endgroup$ Commented Aug 26, 2018 at 0:40
  • $\begingroup$ Well, generally you do key agreement to create a new key. I mean, otherwise you could just do it once and continue with the key after (possibly after a challenge / return). But generally modes of operation have a maximum number of times you can reuse a key, and you have to reuse the key correctly (wrt to the IV, for instance). $\endgroup$
    – Maarten Bodewes
    Commented Aug 26, 2018 at 2:52
  • $\begingroup$ When you say "Only the party with the static key pair can be authenticated by the key agreement itself" you mean only the party with the static public key, right? $\endgroup$
    – hfossli
    Commented Nov 20, 2019 at 8:38
  • $\begingroup$ @hfossli No, only the party with a private key can authenticate itself (usually that party also has the public key that comes with the key pair, so I wrote key pair). Obviously anybody can have the static public key, so that's no means of authentication. You authenticate yourself by showing that you have (access to) the private key (operation) where the public key is trusted to be from you by the other party. $\endgroup$
    – Maarten Bodewes
    Commented Nov 20, 2019 at 10:45
  • $\begingroup$ It seems that static-static provides Public Key Authenticated Encryption, the receiver can verify where it was sent from. While ephemeral static would require sign-then-encryption to do similar. Ephemeral-ephemeral seems the most secure, however if my intention is to encrypt something for a party who is offline (delay tolerant network or store-and-forward), then I cannot use ephemeral-ephemeral. Does this mean ECDH-EE is only applicable in situations where both parties are online simultaneously? $\endgroup$ Commented Sep 23, 2022 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.