Other considerations aside, is it possible to use DH with an established public key (together with fixed g, p, q) to safely authenticate a server instead of using some signing algorithm?
In other words, we will replace $SIG_S(Data)$ in some protocol with this scheme. The steps described below can be merged with whatever protocol is used, so it doesn't need to add more steps.
Client $C$ knows $g$, $p$, $q$ and $g^s$.
- $C \rightarrow S : \{ g^c \} $
- Server generates a random value $N_S$.
- $K \leftarrow KDF(N_S, g^{cs})$
- $S \rightarrow C : \{ N_S, HMAC_K(Data) \}$ where $Data$ is the relevant data signed in the protocol we're modifying.
- $C$ constructs $K$ and verifies that the HMAC calculation matches.
Assume that none of $K$, $N_S$, $g^s$ or $g^c$ is ever recycled for any other use (such as key generation).
What I wonder is if this would be an acceptable replacement for signing with DSA/RSA/etc to prove identity in this particular setup.
Examples:
Plain STS with server authentication only
- $C \rightarrow S: \{ g^x$ }
- $S \rightarrow C: \{ g^y, S, \{ SIG_S(g^x, g^y) \}_{K_s} \}$
Plain STS modified
- $C \rightarrow S: \{ g^x, g^c \}$
- $S \rightarrow C: \{ g^y, S, \{ N_S, HMAC_K(g^x, g^y) \}_{K_s} \}$
Plain SIGMA with server authentication only
- $C \rightarrow S: \{ g^x$ }
- $S \rightarrow C: \{ g^y, S, SIG_S(g^x, g^y), MAC_{K_m}(S) \}$
Plain SIGMA modified
- $C \rightarrow S: \{ g^x, g^c \}$
- $S \rightarrow C: \{ g^y, S, N_S, HMAC_K(g^x, g^y), MAC_{K_m}(S) \}$