0
$\begingroup$

Assume Alice has a key pair $(A, a)$ and Bob has a key pair $(B, b)$, where $A = Ga$ and $B = Gb$. In general, the basic rule of crypto says that we should not use the same key for different operations, like in signing and encryption, but I wonder whether in my use case it would be actually possible to use it. Below, I describe the simplified version of my use case.

So Alice and Bob are communicating over an anonymous network, like for example Tor. Also, Alice and Bob from time to time publish (independently of course) some data signed with their private keys. Alice doesn't know Bob, and Bob doesn't know Alice. They only are aware of their advertised identity keys A and B. Alice when sending the message $m$ to Bob uses Diffie Hellman to derive a shared key. First, for each new message, she generates a new ephemeral key $x$ and computes the key shared with Bob as $k = KDF(B^x)$ (alternatively, maybe she could first apply some Hash function on B, i.e., h = H(B) and compute $k = KDF(h^x)$, not sure? ). Next, Alice encrypts $m$ as $c = AES_k(m)$. She concatenates $g^x$ and $c$ as $v = g^x || c$ and sends it to Bob.

So, in my use case, Alice doesn't reveal any information about herself due to the freshly generated ephemeral key and the anonymous channel (which I assume is secure). She doesn't learn anything about Bob others done his identity public key $B$. Also, as long as Bob's secret key is kept safely no one should be able to decrypt the content of $c$ except for Alice and Bob, which is crucial.

So, is there anything that can go wrong here? If for example Bob published let's say a document signed with his private key $b$, does this allow anyone to infer any information about $m$? In general, my question is whether I'm missing any attack which might compromise the confidentiality of the communication between Alice and Bob? Many thanks in advance!

$\endgroup$
4
  • 1
    $\begingroup$ Technically, there is no specific answer to your question! it seems that you are using ECDH to key exchange, however, it seems that you are not really using the ECDH correctly. Secondly. what is your signature algorithm? Why do you need a single key? $\endgroup$ – kelalaka Sep 9 '20 at 18:10
  • $\begingroup$ @kelalaka So the signature pair is ed25519, while for performing DH I thought to turn it into basic curve25519. As for the signature algorithm I'm using EdDSA. The only reason that I want a single pair is because Alice and Bob have to advertise their keys, which I would like to be done by encapsulating it in the address of Alice and Bob. Thus, advertising two keys in the address is a bit too much. $\endgroup$ – Ziva Sep 10 '20 at 7:49
  • 1
    $\begingroup$ You might have answer to your question Using a single Ed25519 key for encryption and signature. $\endgroup$ – kelalaka Sep 10 '20 at 8:03
  • 1
    $\begingroup$ Note that the encryption scheme for $m$ in the question is essentially ECIES given that you first derive a shared secret with the recipient and then run that through a KDF to get a symmetric key. At this point the question asks whether the same key can be re-used for ECIES and ECDSA. $\endgroup$ – SEJPM Sep 14 '20 at 14:29
2
$\begingroup$

While it's technically not (probably) an issue, you should definitely avoid sharing keys between different purposes. RSA uses separate keys for signing and encryption, for example, since an encrypted-and-signed message would cancel out. RSA only signs a hash of the original message, negating this issue, but it still avoids sharing keys because it's simply better not to use the same keys for different purposes.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.