Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no attack on the weak secret possible?

I mean the messages can be sniffed and with an offline dictionary attack or simply bruteforce it should be possible to reveal the secret.

share|improve this question
up vote 2 down vote accepted

I believe that you are talking about one specific version of EKE, which is one of several known Password authenticated key agreement methods (which is the general category of methods that do a key agreement with the property that someone listening into the exchange can't learn anything, and an attacker that poses as one of the two sides can learn no more from a single exchange than whether a specific password was correct).

Now, with that background, here is the answer to your question. With DH-based EKE, yes, both sides exchange their $E_k( g^x )$ and $E_k( g^y)$ values, and yes, the attacker can decrypt both values with a potential password, giving $g^x$ and $g^y$ if his guess is correct, and $D_{k'}(E_k(g^x))$ and $D_{k'}(E_k(g^y))$ if his guess is incorrect. However, EKE uses a special encryption method such that $D_{k'}(E_k(g^x))$ and $D_{k'}(E_k(g^y))$ are also valid public values; possibly $g^z$ and $g^w$, for some $z$ and $w$. This prevents the attacker from learning anything; he cannot test if a specific $g^x$ and $g^y$ generates the correct shared secret (because the DH problem is hard), and checking if they are valid public value tells him nothing (because they're all valid). So, while the attacker can make a list of potential decryptions, there's nothing that distinguishes the correct one from all the wrong ones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.