7.9 Authenticated key agreement
The Diffie-Hellman protocol is a key agreement protocol because it establishes a shared secret between the communicating parties, but it is not an authenticated key agreement protocol. This is illustrated by the MITM attack on Diffie-Hellman we discussed earlier. The MITM attack is possible because Alice and Bob cannot verify each other’s identity.
In 1992, cryptographers Whitfield Diffie, Paul van Oorschot, and Michael J Wiener published a paper describing two-party mutual authentication protocols providing authenticated key agreement, focusing on those using asymmetric techniques [50]. In addition to theoretical fundamentals, they also introduced the now well-known Station-to-Station (STS) protocol, illustrating authenticated key agreement in a simple, elegant manner.
Authenticated key agreement is a cryptographic protocol that allows Alice and Bob to verify each other’s identities and establish a shared secret key in a single protocol...