Key Exchange algorithm to be used for REST framework

Question

I was required to create key exchange module for custom Rest framework which supports document level security in REST requests. Framework has its own security module which allows to encrypt parameter entities in rest request when keys available.

I have done some research and found that ECMQV key exchange algorithm can be use instead of ECDH since it wasn't prone to MIMA attacks.

ECMQV can be used with out prior authentication.But I have seen that MQV has some issues on its usefulness. eg:Its not used in SSL.

My question is,Isn't that MQV can be used to define custom protocol such instance as mine ?

Answer 1

I'm not 100% clear on your question, but I can hopefully offer some guidance:

In general, you should never try to, or have to, create a custom security protocol. It's ill-advised and prone to serious error. Not even the experts trust themselves to do this quickly and/or without a ton of peer review.

Not being familiar with the exact problem you're facing I can simply say this: find out how this has been done successfully in the past with a known-good (secure) protocol, and use that.

Do not try to make your own.