On Optimal Tightness for Key Exchange with Full Forward Secrecy via Key Confirmation

ePrint Report: On Optimal Tightness for Key Exchange with Full Forward Secrecy via Key Confirmation

Kai Gellert, Kristian Gjøsteen, Håkon Jacobsen, Tibor Jager

A standard paradigm for building key exchange protocols with full forward secrecy (and explicit authentication) is to add key confirmation messages to an underlying protocol having only weak forward secrecy (and implicit authentication). Somewhat surprisingly, we show through an impossibility result that this simple trick must nevertheless incur a linear tightness loss in the number of parties …

authentication eprint report exchange explicit forward key messages paradigm protocols report secrecy standard