I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not safe to use the shared key directly?

  • $\begingroup$ Do you have a link to an example? Besides security a reason might be to adjust for different length requirements or possible bias in the binary format of the result. $\endgroup$
    – tylo
    May 25, 2021 at 6:49
  • $\begingroup$ may be this is the dupe Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$? $\endgroup$
    – kelalaka
    May 25, 2021 at 6:50
  • $\begingroup$ Thank you very much! $\endgroup$ May 25, 2021 at 6:58
  • $\begingroup$ Also, see 1.1. on this The Decision Die-Hellman Problem by Dan Boneh $\endgroup$
    – kelalaka
    May 25, 2021 at 7:20
  • $\begingroup$ A more interesting question would be: for a group of order multiple of a prime $q>2^{255}$, would it be computationally possible to distinguish from random the low-order $\left\lceil\log_2 q\right\rceil-128$ bits of the shared secret? $\endgroup$
    – fgrieu
    May 25, 2021 at 7:23