An unknown key-share attack on the MQV key agreement protocol

TL;DR: The MQV key agreement protocol is shown in its basic form to be vulnerable to an unknown key-share attack, and the attack is noteworthy in the principles it illustrates about protocol design.

Abstract: The MQV key agreement protocol, a technique included in recent standards, is shown in its basic form to be vulnerable to an unknown key-share attack. Although the attack's practical impact on security is minimal---a key confirmation step easily prevents it---the attack is noteworthy in the principles it illustrates about protocol design. First, minor “efficiency improvements” can significantly alter the security properties of a protocol. Second, protocol analysis must consider potential interactions with all parties, not just those that are normally online. Finally, attacks must be assessed in terms of system requirements, not just in isolation.