MQV (Menezes–Qu–Vanstone) is an authenticated protocol for key agreement based on the Diffie–Hellman scheme. Like other authenticated Diffie–Hellman schemes, MQV provides protection against an active attacker. The protocol can be modified to work in an arbitrary finite group, and, in particular, elliptic curve groups, where it is known as elliptic curve MQV (ECMQV).
MQV was initially proposed by Alfred Menezes, Minghua Qu and Scott Vanstone in 1995. It was later modified in joint work with Laurie Law and Jerry Solinas.[1] There are one-, two- and three-pass variants.
MQV is incorporated in the public-key standard IEEE P1363 and NIST's SP800-56A standard.[2]
Some variants of MQV are claimed in patents assigned to Certicom.
ECMQV has been dropped from the National Security Agency's Suite B set of cryptographic standards.
__TOC__
Alice has a key pair
(A,a)
A
a
(B,b)
B
b
In the following
\bar{R}
R=(x,y)
\bar{R}=(x\bmod2L)+2L
L=\left\lceil
| \lceillog2n\rceil | |
| 2 |
\right\rceil
n
P
\bar{R}
R
| Step | Operation | |
|---|---|---|
| 1 | Alice generates a key pair (X,x) x X=xP P | |
| 2 | Bob generates a key pair (Y,y) | |
| 3 | Now, Alice calculates Sa=x+\bar{X}a n X | |
| 4 | Bob calculates Sb=y+\bar{Y}b n Y | |
| 5 | Alice calculates K=h ⋅ Sa(Y+\bar{Y}B) K=h ⋅ Sb(X+\bar{X}A) h | |
| 6 | The communication of secret K K |
Note: for the algorithm to be secure some checks have to be performed. See Hankerson et al.
Bob calculates:
K=h ⋅ Sb(X+\bar{X}A)=h ⋅ Sb(xP+\bar{X}aP)=h ⋅ Sb(x+\bar{X}a)P=h ⋅ SbSaP
Alice calculates:
K=h ⋅ Sa(Y+\bar{Y}B)=h ⋅ Sa(yP+\bar{Y}bP)=h ⋅ Sa(y+\bar{Y}b)P=h ⋅ SbSaP
So the shared secrets
K
K=h ⋅ SbSaP
The original MQV protocol does not include user identities of the communicating parties in the key exchange flows. User identities are only included in the subsequent explicit key confirmation process. However, explicit key confirmation is optional in MQV (and in the IEEE P1363 specification). In 2001, Kaliski presented an unknown key-share attack that exploited the missing identities in the MQV key exchange protocol.[3] The attack works against implicitly authenticated MQV that does not have explicit key confirmation. In this attack, the user establishes a session key with another user but is tricked into believing that he shares the key with a different user. In 2006, Menezes and Ustaoglu proposed to address this attack by including user identities in the key derivation function at the end of the MQV key exchange.[4] The explicit key confirmation process remains optional.
In 2005, Krawczyk proposed a hash variant of MQV, called HMQV.[5] The HMQV protocol was designed to address Kaliski's attack (without mandating explicit key confirmation), with the additional goals of achieving provable security and better efficiency. HMQV made three changes to MQV:
\bar{X}=H(X,B)
\bar{Y}=H(Y,A)
A
B
HMQV claims to be superior to MQV in performance because it dispenses with the operations in 2) and 3) above, which are mandatory in MQV. The HMQV paper provides "formal security proofs" to support that dispensing with these operations is safe.
In 2005, Menezes first presented a small subgroup confinement attack against HMQV.[6] This attack exploits the exact missing of public key validations in 2) and 3). It shows that when engaged with an active attacker, the HMQV protocol leaks information about the user's long-term private key, and depending on the underlying cryptographic group setting, the entire private key may be recovered by the attacker. Menezes proposed to address this attack by at least mandating public key validations in 2) and 3).
In 2006, in response to Menezes's attack, Krawczyk revised HMQV in the submission to IEEE P1363 (included in the IEEE P1363 D1-pre draft). However, instead of validating the long-term and ephemeral public keys in 2) and 3) respectively as two separate operations, Krawczyk proposed to validate them together in one combined operation during the key exchange process. This would save cost. With the combined public key validation in place, Menezes's attack would be prevented. The revised HMQV could still claim to be more efficient than MQV.
In 2010, Hao presented two attacks on the revised HMQV (as specified in the IEEE P1363 D1-pre draft).[7] The first attack exploits the fact that HMQV allows any data string other than 0 and 1 to be registered as a long-term public key. Hence, a small subgroup element is allowed to be registered as a "public key". With the knowledge of this "public key", a user is able to pass all verification steps in HMQV and is fully "authenticated" in the end. This contradicts the common understanding that "authentication" in an authenticated key exchange protocol is defined based on proving the knowledge of a private key. In this case, the user is "authenticated" but without having a private key (in fact, the private key does not exist). This issue is not applicable to MQV. The second attack exploits the self-communication mode, which is explicitly supported in HMQV to allow a user to communicate with himself using the same public key certificate. In this mode, HMQV is shown to be vulnerable to an unknown key-share attack. To address the first attack, Hao proposed to perform public key validations in 2) and 3) separately, as initially suggested by Menezes. However, this change would diminish the efficiency advantages of HMQV over MQV. To address the second attack, Hao proposed to include additional identities to distinguish copies of self, or to disable the self-communication mode.
Hao's two attacks were discussed by members of the IEEE P1363 working group in 2010. However, there was no consensus on how HMQV should be revised. As a result, the HMQV specification in the IEEE P1363 D1-pre draft was unchanged, but the standardisation of HMQV in IEEE P1363 has stopped progressing since.