<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">My understanding, though I’m having trouble tracking down the reference at the moment, is that standard ephemeral-static DH has good properties and takes one less exponentiation:</span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> S = aB = bA</span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> S’ = a’B’ = b’A’</span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> K = KDF (S || S’)</span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Do you have a reason to prefer the triple version? </span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This version is defined in X9.42 as dhHybrid1, and X9.42 contains various security claims about the properties of this approach, but it was written in 2003 and analysis has got more rigorous since then so there may be more up-to-date statements about it. </span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Cheers</span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">William</span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Curves [mailto:<a href="mailto:curves-bounces@moderncrypto.org">curves-bounces@moderncrypto.org</a>] <b>On Behalf Of </b>Tony Arcieri<br> <b>Sent:</b> Tuesday, April 08, 2014 9:18 PM<br><b>To:</b> <a href="mailto:curves@moderncrypto.org">curves@moderncrypto.org</a><br><b>Subject:</b> [curves] Forward secrecy with "triple Diffie-Hellman"</span></p> <p class="MsoNormal"> </p><div><p class="MsoNormal">Trevor described this idea to me once and I haven't really seen it written down anywhere. It's an alternative to something like the CurveCP handshake for a transport encryption protocol which provides forward secrecy by deriving a unique session key each time using ephemeral D-H keys. It couples authentication to confidentiality in ways that might bother some, but at the same time is incredibly simple and I think that's an advantage in and of itself.</p> <div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Let's say Alice has the following elliptic curve D-H keys:</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">a: long-lived private key</p> </div><div><p class="MsoNormal">A: long-lived public key<br clear="all"></p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Alice will also generate a' and A' for each session, which are short-lived session keys.</p> </div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Bob likewise has b, B , b', and B' respectively.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Alice can do:</p></div> <div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"> a * B' || a' * B' || a' * B</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">(The "*" character here represents Curve25519 scalar multiplication)</p> </div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Bob can do the reciprocal operation and derive the same shared secret string:</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"> b * A' || b' * A' || b' * A</p> </div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">These secret strings can then be used as input to a KDF to create a session key.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"> If these keys haven't been tampered with in-flight, Alice and Bob should derive the same session key, and can authenticate each other via their long-lived public keys.</p></div><div><p class="MsoNormal"> </p></div><div> <p class="MsoNormal">Does this seem correct, and if so, does anyone know of any literature on this approach?</p></div><div><p class="MsoNormal"> </p></div><p class="MsoNormal">-- <br>Tony Arcieri</p></div></div></div></body></html>