3
$\begingroup$

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of them, but it may require N-1 key exchange rounds. Is there another way to generate shared secret among N participants with less rounds required than ECDH?

$\endgroup$
4
  • 2
    $\begingroup$ I think what you want is somtimes called "conference keying protocol" for which e.g. the Burmester-Desmedt protocol is one example which requires two rounds of broadcasts (ie everyone broadcasts a value, makes a computation based on the received values makes another broadcast and then computes the shared key). The description can be found in the handbook of applied cryptography (section 12.8 / protocol 12.78 (PDF)). As I lack knowledge whether this protocol is still secure / state-of-the-art I don't answer. $\endgroup$
    – SEJPM
    Sep 6, 2018 at 14:24
  • 1
    $\begingroup$ This paper and its references may prove useful. $\endgroup$
    – SEJPM
    Sep 6, 2018 at 14:26
  • 1
    $\begingroup$ None of the AKE suggestions actually work directly for messaging, since messaging is asynchronous: when Maven wants to group message Lucy and Steve, they might not be online. It should still be possible for Maven to send the message now. Therefore one needs something more clever, like Signal does (uploading pre-keys to server) or like here eprint.iacr.org/2017/666 for groups. $\endgroup$
    – user4621
    Sep 6, 2018 at 20:30
  • $\begingroup$ i need just shared secret for all of participants. my messages will be broadcasted to the group through the server. when somebody is offline he can accept a message later. $\endgroup$
    – milo
    Sep 7, 2018 at 10:54

1 Answer 1

3
$\begingroup$

Well, there are many options to do so. One of them and the most easy to implement and naive one is to do one of the following:

  • Each participant sends its own temporary symmetric secret key to others via pairwise secure channels. Every time each participant receives a message is received from them it uses this key to decrypt it (I think WhatsApp does this using Signal's sender keys).

  • The rooms initiator / owner (the one who wants to talk) sets up pairwise key generation with the one who participates and sends the common room/chat key.

An another option (and the most efficient one) is to use a group key agreement protocol like ART or the one (n+1)sec uses.

The only difference is when you use Diffie-Hellman in each protocol modify it to use the variety of Diffie-Hellman that uses elliptic curves or even deniable group agreements such as 3XDH like Signal does.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.