[curves] Forward secrecy with "triple Diffie-Hellman"

[Trevor Perrin]

On Tue, Apr 8, 2014 at 6:17 PM, Tony Arcieri <bascule at gmail.com> wrote:
>
> Does this seem correct, and if so, does anyone know of any literature on
> this approach?

It's similar to a bunch of things (Kudla & Paterson, KEA / KEA+, NAXOS, Ntor):

http://www.isg.rhul.ac.uk/~kp/ModularProofs.pdf
http://research.microsoft.com/en-us/um/people/klauter/security_of_kea_ake_protocol.pdf
http://research.microsoft.com/pubs/81673/strongake-submitted.pdf
http://cacr.uwaterloo.ca/techreports/2011/cacr2011-11.pdf

I'd like to present more analysis of this, but I'm on vacation, I'll
try to get to that next week.


Trevor