Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is exposed at some point in time the past sessions are still in secret?

I tried it using the regular Diffie-Hellman key-exchange protocol with passing a signature of K to the server, but in every version of it a MITM can impersonate the client and te server and watch all the session...

  • 1
    You mean SSL? ;) Commented Jan 13, 2014 at 21:29
  • SSL uses certificates. I mentioned that the protocol shouldn't rely on certificate or at any 3rd party.
    – Bush
    Commented Jan 13, 2014 at 21:42

1 Answer 1


Yes, it can be done. This is called a Password Authenticated Key Exchange. Such protocols reuse "asymmetric crypto" elements (such as Diffie-Hellman) and mix them "smartly" with a shared secret, so that:

  • Client and server authenticate each other with regards to the shared secret.
  • Guessing the shared secret does not allow decrypting past sessions.
  • Nothing in what is recorded gives enough information to test potential values for the shared secret.

The third condition implies that a low-entropy shared secret, e.g. a "password", can still safely be used, hence the name for this kind of protocol. The cryptographic concept was invented in 1992 by Bellovin and Merrit, under the name "encrypted key exchange" (formally, a DH key exchange in which messages are symmetrically encrypted with the shared secret, so that decryption with the wrong secret still yields syntaxically valid DH messages -- the actual mathematical requirements are subtle).

In the context of SSL/TLS, a standard PAKE protocol has been defined, under the name SRP (see also the Wikipedia page). SRP is good. Unfortunately, Web browsers don't seem to support it (yet).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .