68.82.204.206: Added citation for Mandelbrot quote.

2014-02-28T12:24:32Z

Added citation for Mandelbrot quote.

en>Khazar2: clean-up, MOS:HYPHEN, replaced: widely- → widely using AWB

2013-11-03T21:19:08Z

clean-up, MOS:HYPHEN, replaced: widely- → widely using AWB

New page

'''MQV''' ('''Menezes–Qu–Vanstone''') is an [[authentication|authenticated]] [[protocol (cryptography)|protocol]] for [[key agreement]] based on the [[Diffie–Hellman]] scheme. Like other authenticated Diffie-Hellman schemes, MQV provides protection against an active attacker. The protocol can be modified to work in an arbitrary [[finite group]], and, in particular, [[elliptic curve]] groups, where it is known as '''elliptic curve MQV (ECMQV)'''.

MQV was initially proposed by [[Alfred Menezes|Menezes]], Qu and [[Scott Vanstone|Vanstone]] in 1995. It was modified with Law and Solinas in 1998. There are one-, two- and three-pass variants.

MQV is incorporated in the public-key standard [[IEEE P1363]].

Some variants of MQV are claimed in patents assigned to [[Certicom]] [http://www.certicom.com/index.php?action=ip,protocol].

MQV has some weaknesses that were fixed by [[HMQV]] in 2005 [http://eprint.iacr.org/2005/176]; see [http://eprint.iacr.org/2005/205], [http://www.ams.org/notices/200708/tx070800972p.pdf], [http://www.ams.org/notices/200711/tx071101454p.pdf] for an alternative viewpoint.

ECMQV has been dropped from the National Security Agency's [[NSA Suite B|Suite B]] set of cryptographic standards.

Both MQV and HMQV have weaknesses, that are fixed in the FHMQV protocol (see [http://eprint.iacr.org/2009/408])

__TOC__

==Description==
Alice has a key pair (''A,a'') with ''A'' her public key and ''a'' her private key and Bob has the key pair (''B,b'') with ''B'' his public key and ''b'' his private key.

In the following <math>\bar{R}</math> has the following meaning. Let <math>R = (x,y)</math> be a point on an elliptic curve. Then <math>\bar{R} = (x\, \bmod\, 2^L) + 2^L</math> where <math>L = \left \lceil \frac{\lfloor \log_{2} n \rfloor + 1}{2} \right \rceil </math> and ''n'' is the order of the used generator point ''P''. So <math>\bar{R}</math> are the first ''L'' bits of the x coordinate of ''R''.

{| class="wikitable"
|-
! Step
! Operation
|-
| 1
| Alice generates a key pair (''X,x'') by generating randomly ''x'' and calculating X=xP with P a point on an elliptic curve.
|-
| 2
| Bob generates a key pair (''Y,y'') in the same way as Alice.
|-
| 3
| Now, Alice calculates <math>S_a = x + \bar{X} a</math> and sends X to Bob.
|-
| 4
| Bob calculates <math> S_b = y + \bar{Y} b</math> and sends Y to Alice.
|-
| 5
| Alice calculates <math>K = h \cdot S_a (Y + \bar{Y}B)</math> and Bob calculates <math>K = h \cdot S_b (X + \bar{X}A)</math> where ''h'' is the cofactor (see [[Elliptic_curve_cryptography#Domain_parameters|Elliptic curve cryptography: domain parameters]]).
|-
| 6
| The communication of secret <math>K</math> was successful. A key for a [[symmetric-key algorithm]] can be derived from ''K''.
|}

Note: for the algorithm to be secure some checks have to be performed. See Hankerson et al.

===Correctness===
Bob calculates:
<math>K = h \cdot S_b (X + \bar{X}A) = h \cdot S_b (xP + \bar{X}aP) = h \cdot S_b (x + \bar{X}a)P = h \cdot S_b S_a P </math>.

Alice calculates:
<math>K = h \cdot S_a (Y + \bar{Y}B) = h \cdot S_a (yP + \bar{Y}bP) = h \cdot S_a (y + \bar{Y}b)P = h \cdot S_b S_a P </math>.

So the keys K are indeed the same with <math>K = h \cdot S_b S_a P </math>

==See also==
* [[Elliptic curve cryptography]]

==References==
* {{cite doi|10.1145/501978.501981}}
* {{cite doi|10.1023/A:1022595222606}}
* {{cite doi|10.1007/10958513_19}}
* A. Menezes, M. Qu, and S. Vanstone, [http://sacworkshop.org/proc/SAC_95_003.pdf Some new key agreement protocols providing implicit authentication], Preproceedings of Workshops on [[Selected Areas in Cryptography]] (1995).
* {{cite doi|10.1007/b97644}}

==External links==
* [http://eprint.iacr.org/2009/408 A Secure and Efficient Authenticated Diffie–Hellman Protocol by Sarr, Elbaz-Vincent, and Bajard]
* [http://eprint.iacr.org/2005/176 HMQV: A High-Performance Secure Diffie–Hellman Protocol by Hugo Krawczyk]
* [http://eprint.iacr.org/2005/205 Another look at HMQV]
* [http://www.cacr.math.uwaterloo.ca/techreports/1998/corr98-05.pdf An Efficient Protocol for Authenticated Key Agreement]
* [http://grouper.ieee.org/groups/1363/WorkingGroup/presentations/hmqv-and-mqv.ppt MQV and HMQV in IEEE P1363 (power point)]

{{Cryptography navbox | public-key}}

{{DEFAULTSORT:Mqv}}
[[Category:Key-agreement protocols]]
[[Category:Elliptic curve cryptography]]

Volatility clustering - Revision history

68.82.204.206: Added citation for Mandelbrot quote.

en>Khazar2: clean-up, MOS:HYPHEN, replaced: widely- → widely using AWB