<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">What about using a construction which is already proved secure, such as tripleDH or (patented) FHMQV?</div><div class=""><br class=""></div><div class="">TripleDH: client->server, server->client ephemeral keys.</div><div class="">key = HKDF(client eph * server longterm, client eph * server eph, server eph * client longterm)</div><div class=""><br class=""></div><div class="">— Mike</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On Jun 11, 2015, at 6:57 AM, Jason A. Donenfeld <<a href="mailto:Jason@zx2c4.com" class="">Jason@zx2c4.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Jun 11, 2015 at 3:18 AM, Daniel Kahn Gillmor <span dir="ltr" class=""><<a href="mailto:dkg@fifthhorseman.net" target="_blank" class="">dkg@fifthhorseman.net</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">One risk here is that you end up re-using the same key on each<br class="">
connection, and in each direction.</blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
If the AE algorithm you're using has any limit on the number of<br class="">
different messages you can safely encrypt under the same key</blockquote><div class=""><br class=""></div><div class="">I do use a random 12 byte nonce (chacha20poly1305 construction), but still - you raise a good point.</div><div class="">So -- what if I mix a public salt of considerable size into the mix during key derivation?</div><div class=""><div class=""><br class=""></div><div class="">1. client -> server:<br class=""> salt = random_bytes(32)</div><div class=""> key1 = HKDF(client longterm private key * server longterm public key, salt)</div><div class=""> salt | AUTHENTICATED_ENCRYPTION(client ephemeral public key, key1)</div><div class="">2. server -> client:</div> salt = random_bytes(32)<div class=""> key2 = HKDF(server longterm private key * client longterm public key, salt)</div><div class=""> salt | AUTHENTICATED_ENCRYPTION(server ephemeral public key, key2)</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Also - is this general approach a *valid* way of avoiding needing Ed25519 signatures?</div><div class=""><br class=""></div></div>
</div></div>
_______________________________________________<br class="">Noise mailing list<br class=""><a href="mailto:Noise@moderncrypto.org" class="">Noise@moderncrypto.org</a><br class="">https://moderncrypto.org/mailman/listinfo/noise<br class=""></div></blockquote></div><br class=""></body></html>