Re: [Cfrg] On the use of Montgomery form curves for key agreement

[Nico Williams <[e-mail]>]

On Mon, Sep 8, 2014 at 2:34 PM, Andy Lutomirski <[e-mail]> wrote:
> OK, I'll bite.
>
> If the various standards are to be interpreted as permitting parties
> to reuse their ephemeral DH keys for a short time, *which party* is
> allowed to do so?  I bet that, if both parties in a DH exchange reuse
> their ephemeral keys in multiple DH exchanges with each other, the
> security properties of various protocols degrade in varying amounts
> from "anything resembling a security proof is invalidated" to
> "completely insecure".
>
> Certainly the any exchange of the form K = H(g^(a+b)) followed by use
> of most AEADs (e.g. GCM, most things using Poly1305, etc) starting
> with IV 0 and key K (or a hash of K) will fail catastrophically.

This is true, but we have nonces for this.  Alternatively, if we want
no nonces (to avoid them being used to leak key material) then one
party at least must never reuse keys.  The party where reuse gets the
most wins is the server-side.

>> PFS depends on timely destruction of private keys, not non-reuse.
>
> And integrity, and possibly even confidentiality, depends on non-reuse
> of derived keys... :)

Yes, of course.  Again, nonces.

Nico
--