NIKE ⇒ KE

Fully-black-box reduction · standard model · folklore · security loss: tight: the NIKE challenge is forwarded unchanged

Statement

If $(\mathsf{Gen},\mathsf{Combine})$ is a NIKE, the one-round protocol in which $A$ and $B$ sample $({\mathsf{pk}}_A,{\mathsf{sk}}_A),({\mathsf{pk}}_B,{\mathsf{sk}}_B)\leftarrow \mathsf{Gen}(1^{\lambda })$, send their public keys, and output $k=\mathsf{Combine}({\mathsf{sk}}_A,{\mathsf{pk}}_B)=\mathsf{Combine}({\mathsf{sk}}_B,{\mathsf{pk}}_A)$ is a key exchange secure against eavesdroppers — folklore.

Sketch

The transcript is $({\mathsf{pk}}_A,{\mathsf{pk}}_B)$, so a distinguisher between $({\mathsf{pk}}_A,{\mathsf{pk}}_B,k)$ and $({\mathsf{pk}}_A,{\mathsf{pk}}_B,u)$ for $u\stackrel{\$}{\leftarrow }\mathcal{K}$ is verbatim a NIKE distinguisher for one honest pair.

Notes

• Instantiated with the Diffie–Hellman NIKE (DDH ⇒ NIKE), the protocol is the Diffie–Hellman key exchange of DH76.