title: Ephemeral ECDH (ECDHE) using OpenSSL EVP
body: <p>So, I'm trying to perform a key exchange using the OpenSSL EVP methods for elliptic curve DH to derive a shared secret. This is necessary to provide strong security using AES in GCM mode for a custom protocol.</p>
  
  <p>Problem is, I can only seem to find information and examples about exchange of static keys (ECDH) (see <a href="https://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman" rel="nofollow noreferrer">here</a>).</p>
  
  <p>To make my key exchange "ephemeral", do I do the following?</p>
  
  <ol>
  <li>Generate a new "ephemeral" public and private key on the server  (pub_s_e,priv_s_e) and on the client (pub_c_e, priv_c_e) using <code>EVP_PKEY_keygen</code></li>
  <li>Sign the new ephemeral public keys with the master private key on both the client and server (sign pub_s_e with priv_s on the server, pub_c_e with priv_c on the client) using <code>EVP_DigestSign</code> functions.</li>
  <li>Exchange the signed ephemeral public keys between client and server (can be in cleartext).</li>
  <li>Authenticate the server's ephemeral public key against the known master public key for the server, authenticate the client's ephemeral public key against the known master public key for the client using <code>EVP_DigestVerify</code> functions.</li>
  <li>Perform ECDH to derive a shared secret, hash it (to remove the weak bits) and using a key derivation function like <code>EVP_BytesToKey</code> to get an encryption key and initialization vector (IV) for AES.</li>
  <li>Encrypt as usual using the derived key and IV.</li>
  </ol>
  
  <p>This would seem to provide perfect forward secrecy since a compromise of the master keys would allow signing of future keys but not allow retrieval of past ephemeral keys.</p>
  
  <p>Am I missing anything?</p>