4
$\begingroup$

OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org

It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how it combines the two? My main source of confusion is that the description seems to be saying that the client creates just one set of keys (I am assuming NTRU key pair), but where is the ECC keypair and how is it being used?

|improve this question
$\endgroup$
  • 2
    $\begingroup$ Presumably it simultaneously does an sntrup4591761 key agreement and an X25519 key agreement simultaneously, and then authenticates the transcript of both of them, and derives a single session key by hashing the two key agreement results with a KDF? $\endgroup$ – Squeamish Ossifrage Apr 25 at 15:31
  • $\begingroup$ @SqueamishOssifrage I compiled and ran it, to confirm that it generates two sets of keypairs, but I could only find one keypair (the X25519 one) ... isn't that strange? Also what do you mean by the 'transcript'? Thanks! $\endgroup$ – xkcd Apr 26 at 9:59
  • $\begingroup$ When Alice sends Bob her ephemeral public key $A = [a]G$, and Bob returns his ephemeral public key $B = [b]G$, and they derive the shared secret $k = H([ab]G)$, they presumably want to make sure they agree on the same shared secret and are not actually both talking to Mallory. So Bob authenticates the transcript of everything that he sent and received on the network—sent $B$, received $A'$ (possibly equal to $A$, possibly forged)—and likewise Alice, using long-term identity keys. Hashing a running transcript is a standard technique in modern protocols like TLS 1.3 and Noise. $\endgroup$ – Squeamish Ossifrage Apr 26 at 13:50
  • 1
    $\begingroup$ Post-quantum encryption and post-quantum authentication are qualitatively very different beasts. An eavesdropper today can save ciphertexts to retroactively decrypt tomorrow with a quantum computer. But a forger tomorrow can't retroactively change decisions that you made today no matter how big and juicy their quantum computer is. That's why developing and deploying post-quantum encryption and key agreement today is so much more important than deploying post-quantum authentication. $\endgroup$ – Squeamish Ossifrage Apr 26 at 14:48
  • 1
    $\begingroup$ Note that X25519 static-static or static-ephemeral key agreement can be used to perform entity authentication of the party holding the static private key(s). You could use sntrup4591761 to (help) calculate the session keys. You would not need Ed25519 for signature generation. Just thinking along, I'll try to have a look at the actual protocol later. $\endgroup$ – Maarten Bodewes♦ Apr 27 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.