0
$\begingroup$

Alice and Bob have a pre-shared long-term Ed25519 key used for veryfying/signing ephemeral keys.

They have a shared key which resulted from the DH exchange. They compute HKDF SHA256 of the shared key to use as the AES GCM key.

Should they sign the cipher to make sure a man in the middle didn't change it? If yes, is it safe to send the cipher + signature + HKDF salt in the same message?

$\endgroup$
  • $\begingroup$ But, he can still read the message, right, at least the first one before you detect. $\endgroup$ – kelalaka Sep 24 at 11:20
  • $\begingroup$ In this context, if the attacker sent his public key to both, then yes. However, I'm signing the ephemeral public keys with a pre-shared long-term Ed25519 key to avoid this. $\endgroup$ – bilc Sep 24 at 11:28
  • $\begingroup$ If you don't care that the attacker can read your messages, you don't need encryption, just send the messages with an authentication. $\endgroup$ – kelalaka Sep 24 at 11:39
  • $\begingroup$ @kelalaka thank you! $\endgroup$ – bilc Sep 24 at 11:41
0
$\begingroup$

GCM is an authenticated encryption scheme; it allows Alice and Bob to detect if messages have been tampered. If the DH exchange is authenticated, then you don't need to sign anything.

$\endgroup$
  • $\begingroup$ If the MitM attack is successful, he can read it change it. The OP newly revealed that they have a pre-shared long-term Ed25519 key. $\endgroup$ – kelalaka Sep 24 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.