Ephemeral Diffie-Hellman in a symmetric crypto context I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session keys. My question is, is it sufficient to just encrypt the key exchange using the long-term key, or should that be also authenticated?
The key exchange should also be authenticated. $\:$ GCM mode would mostly do that;

however, you should authenticate an indication of which message is for Diffie-Hellman.

(For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data  =  0 || application's_associated_data for application-level messages.)