Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?

Question

I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can't pin down what the actual weakness is, if there is one. Is a scheme like this OK or is it known to be vulnerable?

Answer 1

This was actually the original proposal of Whit Diffie and Martin Hellman back in 1976: Alice puts $g^a$ in the telephone book and keeps $a$ secret, Bob does likewise with $g^b$ and $b$, and whenever Alice and Bob want to have a conversation they use $g^{ab}$ as a shared secret key.

The main trouble is that you expose an oracle for $h \mapsto h^x$, where $x$ is your secret key, to anyone who wants to have a conversation with you. If the group we're working in has many subgroups of small orders $\ell_1, \ell_2, \dotsc, \ell_n$, then the adversary can feed you points $h_1, h_2, \dotsc, h_n$ of those orders in order to learn $x \bmod \ell_1,$ $x \bmod \ell_2,$ $\dotsc,$ $x \bmod \ell_n$—this is the Lim–Lee active small-subgroup attack.

But if we operate in a group of prime or nearly prime order, that doesn't leak much information—for finite-field DH, for instance, we can use a safe prime $p = 2q + 1$, meaning that $q$ is also prime, so the only possible subgroup orders are $\{1,2,q,2q\}$, and we can choose $x \equiv 0 \pmod 2$ so that the adversary learns nothing from this.

Of course, if an adversary ever breaks into your computer and learns $x$, then they can also decrypt past conversations—the longer you use a secret key for encryption, the more conversations are vulnerable to retroactive decryption. So you might want to use a long-term secret only for authentication and do a fresh key agreement per conversation, somewhat like Signal does—and pay attention to when you erase keys. (A protocol that involves erasing keys is sometimes said to have ‘forward secrecy’, but I recommend against using that term because it obscures when you erase keys.)