I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward secrecy. Disco already implements Noise_NNpsk2 but does not offer Noise_NKpsk2. I at first considered using Noise_NKpsk2, though the more I think about the the more it seems like Noise_NNpsk2 might work too!


Consider two entities A, B, where B has a key printed in a spot which we can guarantee is only visible to A. Entity B is computationally much weaker and cannot take any pre-messages. Concretely, A is a local server and B is some IoT device without any possibility of user input.

Assume A wants to initiate a handshake with B. If we consider the differences between the two schemes Noise_NNpsk0, Noise_NKpsk2, the only security-relevant differences are that in Noise_NKpsk2 A has the extra authentication measure of the static public key of B. As we assume that the PSK printed on B can only be seen by A, I reckon that the extra assurance of the static public key of B doesn't add anything!

Hence, my question:

What are motivations to go with Noise_NKpsk2 over Noise_NNpsk0 given the assumptions of the "hidden" PSK only visible to A?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.