# How to handle multiple key-agreements

If I would use two different key-agreements e.g. SIDH and ECDH how would I handle these both derived keys?

Is there a different between XOR or SHA-256 the two keys? (Would one reduce the level of security?)
Or is there another safe method?

### 1. XOR

key = SIDH ⊕ ECDH


### 2. SHA-256

key = SHA-256(SIDH, ECDH)

• I'm not sure if I understand your question correctly, but you can't retrieve the key again from a SHA256 hash since it's a (presumed) one-way function. – AleksanderRas Jul 18 '19 at 8:05
• I believe the question is: how do I combine two key agreement algorithms in such a way that the resulting algorithm is at least as strong as the strongest of the two ingredients? I believe one uses combination method #2, but I'm not sure what issues #1 has (in some contexts it might allow an active attacker to control one party's view of the shared key, while #2 just allows them to change it in an unpredictable fashion) – Jack Schmidt Jul 18 '19 at 8:45

## 1 Answer

If you are doing an ECDH key agreement $$[a]B = [b]A = [ab]G$$, you should be hashing the ECDH shared secret to derive a key $$k = H([ab]G)$$ anyway instead of using $$[ab]G$$ directly, for various reasons. More than that, you should hash the transcript of the key agreement in too, giving $$k = H([ab]G, A, B, \mathit{etc.})$$. Here $$H$$ might be SHA-256 or HKDF-SHA256 or BLAKE2b, with inputs encoded uniquely so that two transcripts can't collide.

The same goes for essentially any fancy mathematical magic for agreeing on an element of a fancy mathemagical structure, so it applies to SIDH too. It doesn't really matter much whether you do $$H(\mathit{ecdh}, \mathit{sidh}, \mathit{transcript})$$ or $$H\bigl(2, H(0, \mathit{ecdh}, \mathit{transcript}), H(1, \mathit{sidh}, \mathit{transcript})\bigr)$$, where $$\mathit{ecdh}$$ and $$\mathit{sidh}$$ are the mathemagical elements you summoned from the ECDH and SIDH spells. What matters is mainly that you encode all of the inputs to the hashes uniquely and label each hash input uniquely with its purpose in the protocol (done here using fixed-width numbers 0, 1, 2, but could be done using, say, length-delimited strings).