2
$\begingroup$

I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same key, I want to renew the session keys every 2 minutes. However, for performance reasons I only want to involve the KDC once per hour.

I thought about extending this protocol by making use of the Diffie-Hellman key exchange but this would require generating a new alpha and a prime number each time which is quite expensive, considering it has to be carried out once every two minutes.

Any suggestion how I can extend this protocol in an efficient way please?

$\endgroup$
  • 2
    $\begingroup$ Might I ask the goal of generating a new key every two minutes? Is it to minimize the amount of plaintext encrypted with a single key? Or, is it to reduce the amount of traffic revealed in case one side is subverted? I ask because some easy solutions would deal with the first goal, but not the second. $\endgroup$ – poncho Jan 24 at 19:14
  • 1
    $\begingroup$ Also, why do you think DH requires a new prime number each time? $\endgroup$ – poncho Jan 24 at 19:19
  • $\begingroup$ @poncho I want to generate a new key every two minutes so as to minimize the amount of plaintext encrypted with a single key. And you are right - if I use the Diffie-Hellman I can just generate the prime number only once. $\endgroup$ – CXB Jan 24 at 21:59
2
$\begingroup$

Look into the Signal protocol and its associated Double Ratchet algorithm. This changes DH keys after every message without much overhead. As no prime generation is involved in generating new DH keys, there is no expensive processing that would make this impractical. If you don't want to change as often as once per message, you can perform the ratchet once every n messages, or once every two minutes.

The Double Ratchet algorithm is designed to be what the designers describe as "self-healing". That is, if an attacker manages to transiently compromise the system at any point in time, they will be unable to retrieve any previous messages. Likewise they will not be able to decrypt any future messages. The protocol is fairly complex and must be in order to provide all the necessary security properties and recover from compromise. Simply regenerating your public keys every so often isn't always sufficient.

To improve security even further, you can also generate a new DH modulus from time to time, e.g. once a month. This does require generating new primes and can take a long time, but doing this makes precomputation attacks like logjam less feasible, even if attacking a non-export key becomes possible.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.