Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack

Protocol :

``````      A ---> B : Ep (PK)

B ---> A : Ep(Epk(K))
``````

K is Session Key generated by B

PK is an ephemeral public key generated by A

B transfers K to A using double encryption.

PK is a public key , its meant to be public. I am wondering what is the purpose behind encrypting the epheremal public key PK ??

• I'm not familiar with a protocol that does this, can you provide a specific example? – RoraΖ Nov 20 '14 at 12:22
• @StackzOfZtuffb raz. I have to check , its lifted off my lecture notes – Computernerd Nov 20 '14 at 16:36

The "encryption" step is what makes EKE a Password Authenticated Key Exchange algorithm; the low entropy shared secret (the password) can be tolerated precisely because of that step.

Note that it is a special encryption; we are not talking about something like AES here. The idea can be roughly expressed in the following terms:

• There is a base, unauthenticated key exchange algorithm, e.g. Diffie-Hellman.
• Both parties encrypt their messages with the shared password as key.
• The "encryption" must be such that it converts each message in what could structurally be another valid message for the base key exchange algorithm.
• Each encryption represents a commitment.

The last point is the most important and yet the trickiest to grasp. When Alice sends her Ep(ga) (her half of DH, encrypted with password p), she commits to the password p. She may complete the DH computation, i.e. find the shared DH secret gab, only if she assumes that Bob also used the same password p. A fake Alice, trying to guess p, may try to change her mind afterwards and think: well, I sent Ep(ga) but maybe Bob was using password p', so Bob computed Dp'(Ep(ga)) and ended up with some group element ga' on which he based his DH computations... and there Alice fails, because she cannot know that value a'. The layer of "encryption with p then decryption with p'" puts Alice outside of the inner DH. The net result is that a transcript of a single protocol exchange between Alice and Bob can serve to test only one password, the password p that Alice used initially. This is what protects the password against offline dictionary attacks.

(Everything about EKE and PAKE is in the paragraph above. Read it again and again until you understand it or your head falls off.)

• Trying to fully understand this, so correct me if I'm wrong. So in this scenario, it is required that some weak password `p` has been pre-shared, ideally out-of-band? Now let's call the attacker Eve. If Eve is listening in, she initially sees `E_p(g^a)`, and must brute-force what `p` is, even though `p` is weak. The only way for Eve to verify if her guess of `p` was correct would be to send it to Bob, and hope that Bob was actually using `p`. If Bob wasn't, but was instead using `p'`, then Bob would have next essentially decrypted garbage, so in the next step his resulting shared secret – krb686 Nov 18 '16 at 3:57
• after exponentiation is also garbage. Therefore he doesn't have a shared secret with Alice, so their communication fails. What do you mean by "puts Alice outside of the inner DH"? Is this scenario to be viewed as though Eve is sim ultaneously doing DH with both parties to end up with separate shared keys for both, and able to see traffic in the clear in the middle? – krb686 Nov 18 '16 at 3:58