1
$\begingroup$

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of them, but it may require N-1 key exchange rounds. Is there another way to generate shared secret among N participants with less rounds required than ECDH?

$\endgroup$
  • 1
    $\begingroup$ I think what you want is somtimes called "conference keying protocol" for which e.g. the Burmester-Desmedt protocol is one example which requires two rounds of broadcasts (ie everyone broadcasts a value, makes a computation based on the received values makes another broadcast and then computes the shared key). The description can be found in the handbook of applied cryptography (section 12.8 / protocol 12.78 (PDF)). As I lack knowledge whether this protocol is still secure / state-of-the-art I don't answer. $\endgroup$ – SEJPM Sep 6 '18 at 14:24
  • 1
    $\begingroup$ This paper and its references may prove useful. $\endgroup$ – SEJPM Sep 6 '18 at 14:26
  • 1
    $\begingroup$ None of the AKE suggestions actually work directly for messaging, since messaging is asynchronous: when Maven wants to group message Lucy and Steve, they might not be online. It should still be possible for Maven to send the message now. Therefore one needs something more clever, like Signal does (uploading pre-keys to server) or like here eprint.iacr.org/2017/666 for groups. $\endgroup$ – user4621 Sep 6 '18 at 20:30
  • $\begingroup$ i need just shared secret for all of participants. my messages will be broadcasted to the group through the server. when somebody is offline he can accept a message later. $\endgroup$ – milo Sep 7 '18 at 10:54
2
$\begingroup$

Well There are many options to do so. One of them and the most easy to implement and naive one is to do one of the following:

  • Each participant sends its own temporary symmetric secret key to others via pairwize secure channels. Every time each participant receives a message is reiceived from him/her/it uses this key to decrypt it. (I think WhatApp does this using Signal's Sender Keys)

  • The rooms initator owner (The one who wants to talk) sets up pairwize key generation with the one who participates and sends the common room/chat key.

An another Option (and the most efficient one) is to use a Group Key Agreement protocol like ART or the (n+1)sec uses.

The only Difference is when you use Diffie Hellman in each protocol modify it to use the variety of Diffie hellman that uses Eliptic Curves or even Deniable Group Agreemens Such as 3XDH like signal does.

$\endgroup$
0
$\begingroup$

Since in my problem we don't need to revoke keys or add/delete members I choose pairwise DH approach. Every message is encrypted for every single participant separately.

It's simple and satisfies our requirements.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.