1
$\begingroup$

Is it possible to do a key agreement with ECDH ephemeral-ephemeral without requiring an initial handshake first?

Is it possible to have the key agreement in the same message as the encrypted data with ECDHE?

I know this is possible with ECDH ephemeral-static but that does not have perfect forward secrecy. And with ephemeral-static you need to have a secure way to store the static private key.

Improve this question
$\endgroup$
1

1 Answer 1

Reset to default
2
$\begingroup$

Is it possible to do a key agreement with ECDH ephemeral-ephemeral without requiring an initial handshake first?

Yes, however this is vulnerable to man-in-the-middle (MITM) attacks.

Is it possible to have the key agreement in the same message as the encrypted data with ECDHE?

For the receiver to use an ephemeral key, they would have to send it before you can use it for the exchange. Alternatively they could load a number of ephemeral keys onto a trusted third party server to be retrieved by senders later (this is kind-of what is done by Signal). But usually you'd assume the sender just uses the recipients static key so they know it is going to the right person. In this case, all the ephemeral randomness is provided by the sender, so you really have a KEM (key encapsulation mechanism) rather than a key exchange.

So essentially, if you're willing to forgo authentication and risk impersonation / man in the middle attacks, you can achieve perfect forward secrecy with a KEM, and you can have the receiver regularly rotate the receiving key so they don't have to worry about secure long-term storage (a semi-static key).

Improve this answer
$\endgroup$
7
  • $\begingroup$ Thanks. We are going to add ECDSA static-static to prevent MITM attacks and provide authentication. Our issue right now is on Android we don't have a secure way of securing ECDH private keys (if we go ephemeral-static). $\endgroup$
    – ArcadeRenegade
    Jan 31, 2022 at 5:19
  • 1
    $\begingroup$ Correct, then obviously the receiver would have to store the corresponding private keys themselves securely. How will you manage the static keys for the authentication part on android then? $\endgroup$
    – meshcollider
    Jan 31, 2022 at 5:37
  • 1
    $\begingroup$ This will actually work really well for us then. Thank you. Android KeyMaster and KeyStore both support securely storing ECDSA keys but not ECDH. iOS Secure Enclave has supported ECDH for years so Android is really behind on this. $\endgroup$
    – ArcadeRenegade
    Jan 31, 2022 at 5:48
  • 1
    $\begingroup$ Interesting, I wasn't aware that android keystore didn't support ECDH. Would this work? developer.android.com/reference/android/security/keystore/… $\endgroup$
    – meshcollider
    Jan 31, 2022 at 7:01
  • 1
    $\begingroup$ That looks like it's using an EC keypair stored in KeyStore for ECDH. Perfect thanks! $\endgroup$
    – ArcadeRenegade
    Jan 31, 2022 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.