Editing MQV (section)

==Description==
Alice has a key pair <math>(A,a)</math> with <math>A</math> her public key and <math>a</math> her private key and Bob has the key pair <math>(B,b)</math> with <math>B</math> his public key and <math>b</math> his private key.

In the following <math>\bar{R}</math> has the following meaning. Let <math>R = (x,y)</math> be a point on an elliptic curve. Then <math>\bar{R} = (x\, \bmod\, 2^L) + 2^L</math> where <math>L = \left \lceil \frac{\lceil \log_{2} n \rceil}{2} \right \rceil </math> and <math>n</math> is the order of the used generator point <math>P</math>. So <math>\bar{R}</math> are the first ''L'' bits of the first coordinate of <math>R</math>.

{| class="wikitable"
|-
! Step
! Operation
|-
| 1
| Alice generates a key pair <math>(X,x)</math> by generating randomly <math>x</math> and calculating <math>X=xP</math> with <math>P</math> a point on an elliptic curve.
|-
| 2
| Bob generates a key pair <math>(Y,y)</math> in the same way as Alice.
|-
| 3
| Now, Alice calculates <math>S_a = x + \bar{X} a</math> modulo <math>n</math> and sends <math>X</math> to Bob.
|-
| 4
| Bob calculates <math> S_b = y + \bar{Y} b</math> modulo <math>n</math> and sends <math>Y</math> to Alice.
|-
| 5
| Alice calculates <math>K = h \cdot S_a (Y + \bar{Y}B)</math> and Bob calculates <math>K = h \cdot S_b (X + \bar{X}A)</math> where <math>h</math> is the cofactor (see [[Elliptic curve cryptography#Domain parameters|Elliptic curve cryptography: domain parameters]]).
|-
| 6
| The communication of secret <math>K</math> was successful. A key for a [[symmetric-key algorithm]] can be derived from <math>K</math>.
|}

Note: for the algorithm to be secure some checks have to be performed. See Hankerson et al.

===Correctness===
Bob calculates:
<math>K = h \cdot S_b (X + \bar{X}A) = h \cdot S_b (xP + \bar{X}aP) = h \cdot S_b (x + \bar{X}a)P = h \cdot S_b S_a P </math>

Alice calculates:
<math>K = h \cdot S_a (Y + \bar{Y}B) = h \cdot S_a (yP + \bar{Y}bP) = h \cdot S_a (y + \bar{Y}b)P = h \cdot S_b S_a P </math>

So the shared secrets <math>K</math> are indeed the same with <math>K = h \cdot S_b S_a P </math>