5 of 19
Polish
fgrieu
  • 141k
  • 12
  • 307
  • 588

The reasons to still use DHKE when there is a pre-shared secret are that

  1. It makes confidentiality compromise by passive eavesdropping impossible even for an adversary that knows the shared secret, including if that knowledge comes after interception.
  2. It makes confidentiality compromise by more general (active) attacks impossible without knowledge of the shared secret at time of the attack.

Property 2 implies forward secrecy in DHKE, even though the pre-shared secret does not change;

Symmetric crypto can't give property 1 or 2, but can give forward secrecy (by carefully making the pre-shared secret irreversibly evolve at each session).

Recall that in passive eavesdropping, the adversary intercepts ciphertext but does not modify it. These attacks are by far the easiest to mount.

Recall that forward secrecy is the desirable property that future compromise of a user's secrets can't compromise confidentiality of past exchanges.


An example of protocol giving properties 1&2 is one where users agree on a shared secret $S$, and public information: their respective distinc tidentity $I$ (e.g. bytestrings A and B), a finite group (noted with law $+$ and corresponding scalar multiplication $\times$) of order $q$ and generator $G$ suitable for DHKE (e.g. Ed448-Goldilocks), a symmetric authenticated encryption mode (e.g. AES-256-GCM), a hash function $H$ much wider than the key of the authenticated encryption mode (e.g. SHA-512), and the following protocol, where each communication session goes::

  • Each party generates random secret $x\in[1,q]$, computes $X\gets x\times G$, sends $X$, receives $Y$.
  • Each party compute $Z\gets x\times Y$. Notice that their respective $Z$ are equal and secret in the absence of active attack.
  • Each party computes $H(Z\mathbin\|S\mathbin\|I)$ for it's $I$, splits it into 2 cryptograms $U$ and $V$ (with $U$ of size suitable as key of the authenticated encryption and $V$ the rest), sends $V$, and receives $W$.
  • Each party computes $H(Z\mathbin\|S\mathbin\|I')$ for the other party's identity $I'$, and splits it into 2 cryptograms $U'$ and $V'$ (as above).
  • Only if $V'=W$ does communication proceed for this session, with $U$ used as key for the authenticated encryption towards the other party, and $U'$ used in the other direction.

The first two bullets are DHKE. The rest is purely symmetric cryptography.

fgrieu
  • 141k
  • 12
  • 307
  • 588