I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember $$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$ $$B\to A: (B, g^y, \operatorname{SIG}_b((g^y, A)))$$ insecurity”. I fixed the mistake with $A\to B$, replaced public keys with secret ones in the signature function and added sender identifiers. I do not understand why this protocol is insecure, and I can't find anything about this protocol. I understand it as follows. Upon receiving the first message $(C, X, s)$, Bob aborts if $s$ is not a signature of $(X, B)$ by $C$, otherwise generates $y$, sends $(B, g^y, \operatorname{SIG}_b((g^y, A)))$ and associates the session key $X^y$ with $C$. Upon receiving the second message $(C, Y, s)$, Alice aborts if $s$ is not a signature of $(Y, A)$ by $C$ or $C\neq B$, otherwise associates $Y^x$ with $C$ (Bob).

I have been unsuccessfully trying to implement the attack described in “3.1 BADH and the identity-misbinding attack: A motivating example” in “SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols” by Hugo Krawczyk. This and related papers are the only material on the subject I could find. Suppose that Darth posesses a secret key $d$ and the corresponding public key $D$. Since Alice initiates the session, Alice will think that she is talking to Bob anyway. If Darth replaces the first message with $(D, g^x, \operatorname{SIG}_d((g^x, B)))$, Bob will send $(B, g^y, \operatorname{SIG}_b((g^y, D)))$. I do not see how Darth can persuade Alice to start the session using $g^y$ since Darth does not have $\operatorname{SIG}_b((g^y, A))$.


1 Answer 1


My guess is that when it is written approximately

Can we really have a non-replayable 2-msg protocol?
□ Remember (the question's protocol) insecurity

the author is thinking about an attacker capturing the first message of the exchange $(A, g^x, \operatorname{SIG}_a((g^x, B)))$ and using a replay of that to impersonate Alice.

There are two variants:

  • Declaring victory just because Bob thinks (and the logs of its machine show) that Alice connected again, when she did not.
  • Further, if Alice leaked the $x$ she used in the past, that allows the attacker to get the new shared secret by doing just as Alice normally does, and fully impersonate Alice.
  • $\begingroup$ Well, if $x$ is leaked to Darth, the Darth can calculate the session key $g^{xy}$ and read the session data. The protocol is seriously broken anyway. But Darth can't create a new session, you are right. $\endgroup$
    – beroal
    Jul 23, 2020 at 17:18
  • $\begingroup$ The possibility of leaking x has nothing to do with the insecurity of DH, leaking a private key is a problem for any Cryptosystem, this violates the Kerckhoffs's principle. But your 1st point is right, the attacker may even be succeeded on having the communication established with both Alice and Bob. DH should not be used alone. It's secure if used inside other protocols like TLS or El Gamal, where we have digital certificates. $\endgroup$
    – Maf
    Aug 17, 2021 at 21:50
  • 1
    $\begingroup$ This is also my understanding of Krawczyk's slides. He considers an attack model in which the adversary can reveal ephemeral randomness from any prior session. If this happens in this case, the adversary learns $x$. Of course the original session key $g^{xy}$ is compromised -- this is inevitable for any protocol. However, in this particular protocol the adversary can now impersonate Alice to Bob in future sessions (by replaying this message and using knowledge of $x$ to obtain the session key). Revealing ephemeral randomness should not lead to future impersonation attacks. $\endgroup$
    – Mikero
    Dec 6, 2023 at 16:06
  • 1
    $\begingroup$ I updated my answer to reflect that it wasn't correct and this answer is the correct one. @Mikero I think the protocol would be insecure by replay even in the weaker model that does not allow state reveal. In case, Bob accepts without am honest peer session, breaks explicit authentication. Naturally, the protocol is broken as well in the stronger attacker model. $\endgroup$ Dec 6, 2023 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.