Re: [Cfrg] Key establishment advice (say, for TLS): How about MQV?

[Watson Ladd <[e-mail]>]

Dear all,
I think this is a beautiful idea. It unifies client-auth with
anon-client, a weakness of my proposal, is based on very well
understood primitives, and takes only one round. It's also fairly
efficient.

However, one does need (F?)HMQV, because the unkown-key share attack
on MQV can be mounted if private key possession is not proved. In some
of the environments TLS will run this is an essential property. The
anonymous variant has been analyzed: it's the ACE protocol that Tor is
considering using.

The efficiency is very good, but not the best depending on what
happens. In the usual case signatures will be verified anyway, and the
marginal cost for a signature verification in a batched scheme is
small, and the signature generation cost is a fixed-based
exponentiation on a genus 1 curve. However, the diffie-hellman
exchange can use Kummer surfaces or curves in genus 1 or 2, leading to
major gains in efficiency. Because of the need for signature creation
the gain isn't a full 50%, but until we implement and test it won't be
clear which is faster. Recently genus 2 set a major speed record for
diffie-hellman, and because of technical issues addition isn't
possible in a clean way with fast implementations. (It's analogous to
the Montgomery curve tradeoff)

The proposal is likely fast enough however, and the cleanness of the
exchange (one flow, everything hashed, add your favorite AEAD scheme
on the backend for sending application data back and forth) make me
think that signed DH exchanges might be on the way out. In particular,
the gains from batching aren't achievable in the real world of X509,
because ECDSA isn't batchable, and change won't happen any time soon.

Sincerely,
Watson Ladd