<html><body><span style="display:block;" class="xfm_14984096">
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Hello all!<br/></span><b><span style="font-size:12.0pt;font-family:"Courier New CYR";"></span></b></p><p class="xfmc1"><b><span style="font-size:12.0pt;font-family:"Courier New CYR";"></span></b> <br/></p><p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Recently I chose
the Initial Key Exchange procedure for my project and compare the properties
of known protocols. I found that tDH has certain minor flaws that can be fixed.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"> </span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">The one flaw is the
weak PFS of sender’s ID protection: Eve intercepts Alice’s connection to Bob
and claims as Bob. She follows the tDH protocol, receives the authenticator and
aborts.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Later, by revealing
Bob’s private key, Eve can check Alice participation in this past session.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"> </span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Many other
protocols also inherit this flaw.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">For example, see
the Noise Structure Document:</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"><a href="http://www.noiseprotocol.org/noise.html" target="_blank" rel="noreferrer noopener"><span style="color:blue;">http://www.noiseprotocol.org/noise.html</span></a>
chapter 7.8. “Personality hiding”</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Authors are going
to use signatures in the future. But to use signatures we need the full format
of the points (both x and y coordinates or at least a sign of y), which is
incompatible with X25519 Montgomery format.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"> </span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">There is an elegant
way to fix this flaw by extending tDH using the SPEKE protocol performed in
parallel.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">SPEKE will only require
a Hash2Point implementation based on Elligator2. This is easy to implement with
elementary field math of X25519.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"><br/></span></p><p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">Alice is originator and connect to Bob. <br/></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">SPEKE base point is
derived from the value B * x == X * b where x is ephemeral key of Alice. Both sides compute SPEKE public keys
using random ephemeral private keys independent of DH ephemeral private keys (x and y). The parties
exchange DH and SPEKE keys simultaneously. SPEKE shared secret can be used
to explicitly protect the sender's ID<span>
</span>and is also included into<span> </span>tDH
hash (there will now be four elements) to provide PFS of implicit ID
protecting.</span><span style="font-family:"Courier New CYR";"></span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";"> </span></p>
<p class="xfmc1"><span style="font-size:12.0pt;font-family:"Arial CYR","sans-serif";">SPEKE has only
recently become free so perhaps other effective combinations can be used to
develop protocols with good properties.</span><span style="font-family:"Courier New CYR";"></span></p><p class="xfmc1"><br/></p><p class="xfmc1">Can in be applied in practice?</p><p class="xfmc1"><br/></p><p class="xfmc1">Best regards, Van Gegel.<br/></p>
<pre>
</pre> </span></body></html>