# Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?

I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can't pin down what the actual weakness is, if there is one. Is a scheme like this OK or is it known to be vulnerable?

This was actually the original proposal of Whit Diffie and Martin Hellman back in 1976: Alice puts $$g^a$$ in the telephone book and keeps $$a$$ secret, Bob does likewise with $$g^b$$ and $$b$$, and whenever Alice and Bob want to have a conversation they use $$g^{ab}$$ as a shared secret key.
The main trouble is that you expose an oracle for $$h \mapsto h^x$$, where $$x$$ is your secret key, to anyone who wants to have a conversation with you. If the group we're working in has many subgroups of small orders $$\ell_1, \ell_2, \dotsc, \ell_n$$, then the adversary can feed you points $$h_1, h_2, \dotsc, h_n$$ of those orders in order to learn $$x \bmod \ell_1,$$ $$x \bmod \ell_2,$$ $$\dotsc,$$ $$x \bmod \ell_n$$—this is the Lim–Lee active small-subgroup attack.
But if we operate in a group of prime or nearly prime order, that doesn't leak much information—for finite-field DH, for instance, we can use a safe prime $$p = 2q + 1$$, meaning that $$q$$ is also prime, so the only possible subgroup orders are $$\{1,2,q,2q\}$$, and we can choose $$x \equiv 0 \pmod 2$$ so that the adversary learns nothing from this.
Of course, if an adversary ever breaks into your computer and learns $$x$$, then they can also decrypt past conversations—the longer you use a secret key for encryption, the more conversations are vulnerable to retroactive decryption. So you might want to use a long-term secret only for authentication and do a fresh key agreement per conversation, somewhat like Signal does—and pay attention to when you erase keys. (A protocol that involves erasing keys is sometimes said to have ‘forward secrecy’, but I recommend against using that term because it obscures when you erase keys.)