MQV (Menezes-Qu-Vanstone) is an elliptic-curve key-agreement method for parties that communicate regularly. It combines each party’s long-lived static key pair with a freshly generated ephemeral key pair for every agreement session. The ephemeral public keys must be exchanged before either party can compute the shared secret, giving each connection a new key. section 4.0 section 4.2
Let G be the curve base point, with order n and cofactor r. Alice holds static and ephemeral private scalars k_s,A and k_e,A, with public points P_s,A = k_s,A G and P_e,A = k_e,A G; Bob has the corresponding B values. Static public keys may be transferred before contact, while ephemeral public keys are sent for the current session. section 4.2.1
Each side first forms an implicit-signature scalar from its own private values. For Alice, s_A = k_e,A + avf(P_e,A.x)k_s,A. The associate value function avf takes the lower roughly half-sized portion of an ephemeral public point’s x coordinate and sets the halfway bit: avf(x) = x mod 2^⌈log₂(n)/2⌉ + 2^⌈log₂(n)/2⌉. section 4.2.1 section 4.2.2
Alice then combines Bob’s public inputs as U_B = P_e,B + avf(P_e,B.x)P_s,B and computes z = (s_A U_B).x. Bob performs the symmetric calculation with A’s values. The expanded products produce the same shared point, so both parties use its x coordinate as the shared secret. The NIST form also includes multiplication by the curve cofactor. section 4.2.1 section 4.3
Table 4.1 MQV expanded calculation
| Alice | Bob |
|---|---|
| \(s_A=k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A}\) | \(s_B=k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B}\) |
| \(U_B=P_{e,B}+\text{avf}(P_{e,B}.x)P_{s,B}\) | \(U_A=P_{e,A}+\text{avf}(P_{e,A}.x)P_{s,A}\) |
| \(s_AU_B=(k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A})\) | \(s_BU_A=(k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B})\) |
| \(\cdot(k_{e,B} + \text{avf}(P_{e,B}.x)k_{s,B})G\) | \(\cdot(k_{e,A} + \text{avf}(P_{e,A}.x)k_{s,A})G\) |
Compare the Alice and Bob expansions to see why their differently ordered scalar products reach the same shared point. section 4.2.1
A direct Full ECC MQV implementation follows this flow:
- Generate an ephemeral private scalar with randomness, then multiply it by G to obtain the ephemeral public point. section 4.2.2
- Compute s modulo the base-point order from the local static private key, local ephemeral private key, and avf of the local ephemeral public x coordinate. section 4.3
- Compute U from the peer’s static and ephemeral public points, then multiply U by s; multiply by the cofactor when it exceeds one. section 4.3
- Take the resulting point’s x coordinate as the shared key value and clear temporary point and integer values. section 4.3
Two-sided agreement check
A test generates one ephemeral pair per side, calls the shared-secret routine once from each perspective, and compares the resulting values. In the shown 256-bit run, both hexadecimal key shares match; a mismatch is reported explicitly. section 4.3.3
MQV requires more communication than basic elliptic-curve Diffie-Hellman because ephemeral public keys accompany the static public keys. Its practical benefit is that a new shared key is created for each connection; implementations must still address issues such as unknown key-share attacks. section 4.3 section 4.5
