1
$\begingroup$

I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can't pin down what the actual weakness is, if there is one. Is a scheme like this OK or is it known to be vulnerable?

$\endgroup$
3
$\begingroup$

This was actually the original proposal of Whit Diffie and Martin Hellman back in 1976: Alice puts $g^a$ in the telephone book and keeps $a$ secret, Bob does likewise with $g^b$ and $b$, and whenever Alice and Bob want to have a conversation they use $g^{ab}$ as a shared secret key.

The main trouble is that you expose an oracle for $h \mapsto h^x$, where $x$ is your secret key, to anyone who wants to have a conversation with you. If the group we're working in has many subgroups of small orders $\ell_1, \ell_2, \dotsc, \ell_n$, then the adversary can feed you points $h_1, h_2, \dotsc, h_n$ of those orders in order to learn $x \bmod \ell_1,$ $x \bmod \ell_2,$ $\dotsc,$ $x \bmod \ell_n$—this is the Lim–Lee active small-subgroup attack.

But if we operate in a group of prime or nearly prime order, that doesn't leak much information—for finite-field DH, for instance, we can use a safe prime $p = 2q + 1$, meaning that $q$ is also prime, so the only possible subgroup orders are $\{1,2,q,2q\}$, and we can choose $x \equiv 0 \pmod 2$ so that the adversary learns nothing from this.

Of course, if an adversary ever breaks into your computer and learns $x$, then they can also decrypt past conversations—the longer you use a secret key for encryption, the more conversations are vulnerable to retroactive decryption. So you might want to use a long-term secret only for authentication and do a fresh key agreement per conversation, somewhat like Signal does—and pay attention to when you erase keys. (A protocol that involves erasing keys is sometimes said to have ‘forward secrecy’, but I recommend against using that term because it obscures when you erase keys.)

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.