On 03/14/2013 06:39 AM, Richard Barnes wrote:

It's even simpler than that: Alice and Bob each generate a JWK representing a DH or ECDH key, the exchange them in an IQ. 

http://tools.ietf.org/html/draft-ietf-jose-json-web-key-08

Thank you for pointing me in the right direction!

Please correct me if I'm wrong, but the way I see it is this:

In order to provide authentication and (weak) anonymity, we would have to exchange

1. unauthenticated Diffie-Hellman key exchange <keyreq /> stanzas, used to negotiate a first shared secret, and
   
2. encrypted (with the first shared secret) <keyreq /> stanzas (which wraps the long-lived public keys) to negotiate a second shared secret.

The second shared secret would be the symmetric key used for encrypting the following stanzas. This would protect the long-lived public key from a passive attacker, and provide perfect forward secrecy. Also, any entity could perform additional unauthenticated Diffie-Hellman key exchanges (this time, however, encrypted) to redo the procedure, and add yet another "PFS layer".

As there seems to be some patent-related uncertainty surrounding elliptic curve cryptography[1], I would like to see support for regular Diffie-Hellman keys.

Looking at the IANA JSON Web Key Types registry key types[2], there appear to only be two key types defined: `EC' (Elliptic Curve [DSS] key type) and `RSA' (RFC3447 key type). Could perhaps `DH' be added to this table?

Would `alg' (refer to the the JSON Web Encryption algorithm section[3]) be something like `DH+A128KW'?

All-in-all, would something like the following JWK representation be suitable for the Diffie-Hellman public key exchanges?

{
  "kty": "DH",
  "public-key": "...",
  "prime": "...",
  "generator": "...",
  "use": "enc",
  "alg": "DH+A128KW"
}

[1]: http://en.wikipedia.org/wiki/ECC_patents
[2]: http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-08#section-5.1
[3]: http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-08#section-4.1

Jon