How to do a triple Diffie-Hellman(3 - DH) key agreement in Java using bouncy castle?

Question

There are ample examples on how to do Diffie-Hellman key agreement to compute a shared secret. However, I could not find any example on how to do 3DH in java using bouncy castle(or any security provided to be honest). All of what I am finding, reading is abstract theory, and not actual real implementation/example.

More specifically, how can the three individually computed DH agreements be combined? A good source of reference could be Signal's x3dh agreement protocol :

pseudo code

    DH1 = DH(IKA, SPKB)
    DH2 = DH(EKA, IKB)
    DH3 = DH(EKA, SPKB)
    SK = KDF(DH1 || DH2 || DH3)

or alternatively:

KeyAgreement ka1 = KeyAgreement.getInstance("X448",BouncyCastleProvider.PROVIDER_NAME); ka1.init(iPrivKey); //initator Private Key
ka1.doPhase(rPubKey, true); //recipient Public Key
byte[] secret1 = ka1.generateSecret();
... 

byte[] secret2 = ka2.generateSecret(); 
...

byte[] secret3 = ka3.generateSecret();

To be exactly precise on what I am looking for how to do SK = KDF(DH1 || DH2 || DH3) having already computed DH1 DH2 and DH3 in bouncy castle? I.E how to combine secret1, secret2 and secret3 as input keying material or seed for HKDFParameters?

What exactly is unclear? KDF is defined in chapter _2.2. Cryptographic notation_ of your link as HKDF algorithm. BouncyCastle supports [HKDF](https://www.bouncycastle.org/docs/docs1.5on/org/bouncycastle/crypto/generators/HKDFBytesGenerator.html). — Topaco, Feb 28 '22 at 10:45
@Topaco the documentation shared by does not tell how I can combine three Diffie hellman key agreements. KeyAgreement ka1 = KeyAgreement.getInstance("X448",BouncyCastleProvider.PROVIDER_NAME); ka1.init(iPrivKey); ka1.doPhase(rPubKey, true); byte[] secret1 = ka1.generateSecret(); ... byte[] secret2 = ka2.generateSecret(); ... byte[] secret3 = ka3.generateSecret(); now how do I combine secret1, secret2 and secret3 as input keying material or seed for HKDFParameters? — Uma Priyadarsi, Feb 28 '22 at 12:13
You should post the code in the question and not in the comment, because it is hard to read in the comment. In [2.2 Cryptographic notation](https://signal.org/docs/specifications/x3dh/#cryptographic-notation) is explained e.g. for the input keying material: `IKM = F || KM`, where `KM` is the value passed in `KDF`, so `KM = secret1 || secret2 || secret3` and `F` are 57 `0xFF` bytes (for X448) and `||` means the concatenation of the byte sequences. Also the HKDF parameters `salt` and `info` are explained there. — Topaco, Feb 28 '22 at 12:34
@Topaco you are absolutely right. My bad for not posting in the question. Also many thanks for spelling it out to me that ```||``` is concatenation as per signal documentation. It was all about reading it patiently, and I glossed over it like a chimp :D . I will try this out in my application and then if works out, will post it as an answer. — Uma Priyadarsi, Feb 28 '22 at 13:19

score 0 · Accepted Answer · answered Apr 07 '22 at 05:27

As mentioned by @Topaco it is just plain concatenation of the three shared secrets. Java code follows:

     byte[] getAgreementBytes(PrivateKey privKey,PublicKey pubKey) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException {
        KeyAgreement ka = KeyAgreement.getInstance("X448", BouncyCastleProvider.PROVIDER_NAME);
        ka.init(privKey);
        ka.doPhase(pubKey, true);
        byte[] secret = ka.generateSecret();
        privKey = null;//let gc do it's work
        return secret;
    }
...
...
...

        byte[] secretA = getAgreementBytes(iPrivKeyA,getRPubKeyB());
        byte[] secretB = getAgreementBytes(iPrivKeyB,getRPubKeyC());
        byte[] secretC = getAgreementBytes(iPrivKeyC,getRPubKeyA());

        byte[] secret = new byte[secretA.length + secretB.length + secretC.length];
        System.arraycopy(secretA,0,secret,0,secretA.length);
        System.arraycopy(secretB,0,secret,secretA.length,secretB.length);
        System.arraycopy(secretC,0,secret,secretA.length + secretB.length,secretC.length);

        return secret;

The signal doc also mentions using 57 0xFF bytes (for X448), which I am yet to make sense of. However, the above code works for me.

How to do a triple Diffie-Hellman(3 - DH) key agreement in Java using bouncy castle?

1 Answers1