The responder is initialized with a pre-shared long-term static key, which is assumed to be pre-authenticated out of band by the initiator.
Message A, sent by the initiator, benefits from sender and receiver authentication and is resistant to Key Compromise Impersonation. Assuming the corresponding private keys are secure, this authentication cannot be forged. Message contents benefit from message secrecy and some forward secrecy: the compromise of the responder's long-term private keys, even at a later date, will lead to message contents being decrypted by the attacker. 4,2
Get Model active attacker Get Model passive attacker
Get Implementation written in go Get Implementation written in rust