3 ms·
Alright, how about this situation: Alice's long-term static keypair is S_A/s_a Alice's long-term static public key signature(signed by a trusted third part
by hexafluoride 10y ago
Alright, how about this situation:
Alice's long-term static keypair is S_A/s_a
Alice's long-term static public key signature(signed by a trusted third party) is sign_A
Bob's long-term static keypair is S_B/s_b
Bob's long-term static public key signature(signed by a trusted third party) is sign_B
Alice's per-session ephemeral keypair is E_A/e_a
Bob's per-session ephemeral keypair is E_B/e_b
Alice sends S_A|sign_A|E_A|sign(data=E_A, key=s_a)
Bob sends S_B|sign_B|E_B|sign(data=E_B, key=s_b)
Shared key is generated with kdf(ecdh(E_A, e_b)) == kdf(ecdh(E_B, e_a))
Would this be vulnerable to KCI?
- lvh 10y agoNo. This is roughly how TLS ephemeral suites work with mutual auth. Reusing a key pair for signing and DH (or at least being able to) is why TLS KCI attacks worked against static DH ciphersuites. Static DH certs basically don't exist, but ECDSA does. The important distinction here is that the long-term keys are signing keys, not DH keys.