How secure is ECDH if the public keys are never changed? I have a scenario where I'd like to use Diffie Hellman keys where the public keys are exchanged once and then never changed.

So server generates a key pair (secp256k1 or secp256r1) and sends its public key to client and the client does the same. From that point onward, all the communication is secured by using the derived symmetric key. But these key pairs are never changed. 

My question is how secured is how easy would it be for someone to figure out the symmetric key now that the same key is used for encryption/decryption?
How secure is ECDH if the public keys are never changed?


The following notation of $Gba$ is the $\operatorname{diffie-hellman(Gb, a)}$ or ${g^b}^a$ where we assume Alice' perspective where Alice knows $a$ and $Gb$, not $b$. Bob computes the equivilent $Gab$.

I advise against using straight static-dh where $a$ and $b$ are static and $k$ is unique per pair of users.

$$k = \operatorname{kdf}(Gba)$$

If either key is compromised then a passive adversary who records transactions may recover all messages. Worse, an active adversary may silently MiTM all sessions in real-time.

The full MiTM requires impersonating both sides, which KCI (key compromise impersonation) enables. I.e. If Mallory knows $a$, she can pretend to be Alice to Bob and pretend to be Bob to Alice.

One popular alternative is 3DH, as used in Signal and similar protocols.

$$k = \operatorname{kdf}(Gda \| Gbc \| Gdc)$$

Where $c$ is Alice' ephemeral key and $d$ is Bob's ephemeral key. Notice $Gab$ is not used because it is static and does not introduce additional security as the ephemerals are paired with the static keys providing KCI-resistant mutual authentication and paired together for forward secrecy.

If both of Alice and Bob's keys are compromised. A passive adversary is still unable to recover messages. However, an active adversary may substitute the ephemerals and do the full MiTM again.

If the client is anonymous, you may use 2DH by omitting $a$ and computing instead:

$$k = \operatorname{kdf}(Gbc \| Gdc)$$


  My question is how secured is how easy would it be for someone to figure out the symmetric key now that the same key is used for encryption/decryption?


You must always respect the security contract of any function you use. I.e. Never reuse a $k$ with a single-use AE. Never reuse a $(k,n)$ tuple with an nAE.

If you're using the symmetric key correctly or not is irrelevant to how the key was derived.

Edit: If you're asking if it is safe to shake hands with with many people? Then yes, so long that the construction is safely guarding against bad-keyshare attacks, the result should not reveal anything to an adversary, even if you shake hands directly with them.