Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following:

  • $\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral key pair ($x, X=g^x$). Then $\hat{A}$ sends [$\hat{A},\hat{B}, X, \mathrm{sig}_\hat{A}(X,\hat{B})$] to $\hat{B}$
  • $\hat{B}$ generates the long-term key pair ($sk_B= b$, $pk_B =g^b$) and the ephemeral key pair ($y, X=g^y$). Then $\hat{B}$ sends [$\hat{B},\hat{A}, Y, \mathrm{sig}_\hat{B}(Y,X,\hat{A})$] to $\hat{B}$

Then both compute the session key $\sigma=g^{(x+da)(y+eb)}$ as $\sigma_\hat{A}=(YB^e)^{(x+da)}$ and $\sigma_\hat{B}=(XA^d)^{(y+eb)}$ respectively, with $d=\overline{H}(X,\hat{B})$ and $e=\overline{H}(Y,\hat{A})$

Following are my questions:

  1. if $X$ and $Y$ are pre-computed (before the key-exchange) and available on a TTP, can HMQV be used as an asynchronous key-exchange?
  2. In terms of performance, is HMQV better than X3DH? X3DH computes the session key as $\sigma=\mathrm{KDF}(g^{ay}||g^{bx}||g^{xy})$
  3. is $\sigma = (x+da)(y+eb)G$ the right transformation of HMQV final result in Elliptic curve cryptography?
  4. in the hash function $\overline{H}$, can we discard $\hat{A}$ and $\hat{B}$ without affecting the robustness of HMQV?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.