# Key Exchange - tlsn-docs

# Key Exchange

In TLS, the first step towards obtaining TLS session keys is to compute a shared secret between the client and the server by running the ECDH protocol. The resulting shared secret in TLS terms is called the pre-master secret `PMS`.

With TLSNotary, at the end of the key exchange, the `Server` gets the `PMS` as usual. The `Prover` and the `Verifier`, jointly operating as the TLS client, compute additive shares of the `PMS`. This prevents either party from unilaterally sending or receiving messages with the `Server`. Subsequently, the authenticity and integrity of the messages are guaranteed to both the `Prover` and `Verifier`, while also keeping the plaintext hidden from the `Verifier`.

The 3-party ECDH protocol between the `Server` the `Prover` and the `Verifier` works as follows:

1. `Server` sends its public key Qb​ to `Prover`, and `Prover` forwards it to `Verifier`
2. `Prover` picks a random private key share dc​ and computes a public key share Qc​=dc​∗G
3. `Verifier` picks a random private key share dn​ and computes a public key share Qn​=dn​∗G
4. `Verifier` sends Qn​ to `Prover` who computes Qa​=Qc​+Qn​ and sends Qa​ to `Server`
5. `Prover` computes an EC point (xp​,yp​)=dc​∗Qb​
6. `Verifier` computes an EC point (xq​,yq​)=dn​∗Qb​
7. Addition of points (xp​,yp​) and (xq​,yq​) results in the coordinate xr​, which is `PMS`. (The coordinate yr​ is not used in TLS)

Using the notation from here, our goal is to compute xr​=(xq​−xp​yq​−yp​​)2−xp​−xq​ in such a way that

1. Neither party learns the other party's x value
2. Neither party learns xr​, only their respective shares of xr​.

We will use two maliciously secure protocols described on p.25 in the paper Eﬃcient Secure Two-Party Exponentiation:

- `A2M` protocol, which converts additive shares into multiplicative shares, i.e. given shares `a` and `b` such that `a + b = c`, it converts them into shares `d` and `e` such that `d * e = c`
- `M2A` protocol, which converts multiplicative shares into additive shares

We apply `A2M` to yq​+(−yp​) to get Aq​∗Ap​ and also we apply `A2M` to xq​+(−xp​) to get Bq​∗Bp​. Then the above can be rewritten as:

xr​=(Bq​Aq​​)2∗(Bp​Ap​​)2−xp​−xq​

Then the first party locally computes the first factor and gets Cq​, the second party locally computes the second factor and gets Cp​. Then we can again rewrite as:

xr​=Cq​∗Cp​−xp​−xq​

Now we apply `M2A` to Cq​∗Cp​ to get Dq​+Dp​, which leads us to two final terms each of which is the share of xr​ of the respective party:

xr​=(Dq​−xq​)+(Dp​−xp​)