An ephemeral key is a temporary public–private key pair generated for one key-agreement session. MQV combines it with a static key pair, so recurring communications gain stronger protection than static Diffie–Hellman alone. section 4.0 section 4.2
An elliptic-curve MQV exchange uses ephemeral keys in this flow:
- Generate a random ephemeral private key and multiply it by the curve base point to obtain the ephemeral public key. section 4.2.2
- Transmit both parties’ ephemeral public keys; static public keys may already have been exchanged. section 4.2.1
- Combine each ephemeral private key with its static private key, and combine the corresponding public keys to compute the shared point. section 4.2.1
- Use the shared point’s x-coordinate as the shared secret value. section 4.2.1
Minimal generator
The generator draws a random scalar with mrand(ephm), then computes Eph = ephm·Base. A secure deployment should obtain randomness from a cryptographically secure source; the example uses GMP’s pseudo-random generator. section 4.2.2
Table 4.1 MQV expanded calculation
| Alice | Bob |
|---|---|
| \(s_A=k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A}\) | \(s_B=k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B}\) |
| \(U_B=P_{e,B}+\text{avf}(P_{e,B}.x)P_{s,B}\) | \(U_A=P_{e,A}+\text{avf}(P_{e,A}.x)P_{s,A}\) |
| \(s_AU_B=(k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A})\) | \(s_BU_A=(k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B})\) |
| \(\cdot(k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B})G\) | \(\cdot(k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A})G\) |
Compare Alice’s and Bob’s expanded MQV calculations, including the ephemeral and static contributions on both sides. section 4.2.1
The associate value function derives a compact value from an ephemeral public key’s x-coordinate by masking lower bits and setting a midpoint bit. This value weights the static key in MQV. section 4.2.1 section 4.2.2
