0
$\begingroup$

Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following:

  • $\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral key pair ($x, X=g^x$). Then $\hat{A}$ sends [$\hat{A},\hat{B}, X, \mathrm{sig}_\hat{A}(X,\hat{B})$] to $\hat{B}$
  • $\hat{B}$ generates the long-term key pair ($sk_B= b$, $pk_B =g^b$) and the ephemeral key pair ($y, X=g^y$). Then $\hat{B}$ sends [$\hat{B},\hat{A}, Y, \mathrm{sig}_\hat{B}(Y,X,\hat{A})$] to $\hat{B}$

Then both compute the session key $\sigma=g^{(x+da)(y+eb)}$ as $\sigma_\hat{A}=(YB^e)^{(x+da)}$ and $\sigma_\hat{B}=(XA^d)^{(y+eb)}$ respectively, with $d=\overline{H}(X,\hat{B})$ and $e=\overline{H}(Y,\hat{A})$

Following are my questions:

  1. if $X$ and $Y$ are pre-computed (before the key-exchange) and available on a TTP, can HMQV be used as an asynchronous key-exchange?
  2. In terms of performance, is HMQV better than X3DH? X3DH computes the session key as $\sigma=\mathrm{KDF}(g^{ay}||g^{bx}||g^{xy})$
  3. is $\sigma = (x+da)(y+eb)G$ the right transformation of HMQV final result in Elliptic curve cryptography?
  4. in the hash function $\overline{H}$, can we discard $\hat{A}$ and $\hat{B}$ without affecting the robustness of HMQV?
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.