MQV


MQV is an authenticated protocol for key agreement based on the Diffie–Hellman scheme. Like other authenticated Diffie–Hellman schemes, MQV provides protection against an active attacker. The protocol can be modified to work in an arbitrary finite group, and, in particular, elliptic curve groups, where it is known as elliptic curve MQV .
MQV was initially proposed by Alfred Menezes, Minghua Qu and Scott Vanstone in 1995. It was modified with Law and Solinas in 1998. There are one-, two- and three-pass variants.
MQV is incorporated in the public-key standard IEEE P1363 and NIST's SP800-56A standard.
Some variants of MQV are claimed in patents assigned to Certicom.
ECMQV has been dropped from the National Security Agency's Suite B set of cryptographic standards.

Description

Alice has a key pair with her public key and her private key and Bob has the key pair with his public key and his private key.
In the following has the following meaning. Let be a point on an elliptic curve. Then where and is the order of the used generator point. So are the first L bits of the first coordinate of.
StepOperation
1Alice generates a key pair by generating randomly and calculating with a point on an elliptic curve.
2Bob generates a key pair in the same way as Alice.
3Now, Alice calculates modulo and sends to Bob.
4Bob calculates modulo and sends to Alice.
5Alice calculates and Bob calculates where is the cofactor.
6The communication of secret was successful. A key for a symmetric-key algorithm can be derived from.

Note: for the algorithm to be secure some checks have to be performed. See Hankerson et al.

Correctness

Bob calculates:
Alice calculates:
So the shared secrets are indeed the same with

MQV vs HMQV

The original MQV protocol does not include user identities of the communicating parties in the key exchange flows. User identities are only included in the subsequent explicit key confirmation process. However, explicit key confirmation is optional in MQV. In 2001, Kaliski presented an unknown key-share attack that exploited the missing identities in the MQV key exchange protocol. The attack works against implicitly authenticated MQV that does not have explicit key confirmation. In this attack, the user establishes a session key with another user but is tricked into believing that he shares the key with a different user. In 2006, Menezes and Ustaoglu proposed to address this attack by including user identities in the key derivation function at the end of the MQV key exchange. The explicit key confirmation process remains optional.
In 2005, Krawczyk proposed a hash variant of MQV, called HMQV. The HMQV protocol was designed to address Kaliski's attack, with the additional goals of achieving provable security and better efficiency. HMQV made three changes to MQV:
  1. Including the user identities in the key exchange flows: more specifically, letting and where and are identities of Alice and Bob respectively.
  2. Removing the mandatory requirement in MQV that a certificate authority must verify the proof-of-possession of the user's private key during the public key registration. In HMQV, the CA merely needs to check the submitted public key is not 0 or 1.
  3. Removing the mandatory requirement in MQV that a user must verify whether the received ephemeral public key is a valid public key. In HMQV, a user merely needs to check the received ephemeral public key is not 0 or 1.
HMQV claims to be superior to MQV in performance because it dispenses with the operations in 2) and 3) above, which are mandatory in MQV. The HMQV paper provides "formal security proofs" to support that dispensing with these operations is safe.
In 2005, Menezes first presented a small subgroup confinement attack against HMQV. This attack exploits the exact missing of public key validations in 2) and 3). It shows that when engaged with an active attacker, the HMQV protocol leaks information about the user's long-term private key, and depending on the underlying cryptographic group setting, the entire private key may be recovered by the attacker. Menezes proposed to address this attack by at least mandating public key validations in 2) and 3).
In 2006, in response to Menezes's attack, Krawczyk revised HMQV in to IEEE P1363 and 3) respectively as two separate operations, Krawczyk proposed to validate them together in one combined operation during the key exchange process. This would save cost. With the combined public key validation in place, Menezes's attack would be prevented. The revised HMQV could still claim to be more efficient than MQV.
In 2010, Hao presented two attacks on the revised HMQV. The first attack exploits the fact that HMQV allows any data string other than 0 and 1 to be registered as a long-term public key. Hence, a small subgroup element is allowed to be registered as a "public key". With the knowledge of this "public key", a user is able to pass all verification steps in HMQV and is fully "authenticated" in the end. This contradicts the common understanding that "authentication" in an authenticated key exchange protocol is defined based on proving the knowledge of a private key. In this case, the user is "authenticated" but without having a private key and 3) separately, as initially suggested by Menezes. However, this change would diminish the efficiency advantages of HMQV over MQV. To address the second attack, Hao proposed to include additional identities to distinguish copies of self, or to disable the self-communication mode.
Hao's two attacks were discussed by members of the IEEE P1363 working group in 2010. However, there was no consensus on how HMQV should be revised. As a result, the HMQV specification in the IEEE P1363 D1-pre draft was unchanged, but the standardisation of HMQV in IEEE P1363 has stopped progressing since.