The most famous key exchange algorithm with perfect forward-secrecy.
0
votes
1answer
53 views
Does SRP reduce to DH key echange when shared password is not secret?
I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later.
I ...
0
votes
0answers
27 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites [migrated]
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
3
votes
3answers
894 views
What should be the size of a Diffie-Hellman private key?
I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman).
The RFC documents state:
The private values $a$ and $b$ SHOULD be at least ...
3
votes
1answer
50 views
Chosen ciphertext insecurity in an ElGamal variant
I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
2
votes
1answer
42 views
How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?
I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
2
votes
1answer
70 views
Potential vulnerability in DH key selection - am I understanding this right?
I'm reading through a DH implementation, and I think I found a potential hole.
Public $p$ and $g$ values are properly selected.
A candidate secret value $\bar a$ is pseudo-randomly selected such ...
2
votes
1answer
82 views
Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?
I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
0
votes
0answers
80 views
Secure modulus length for Diffie-Hellman
What is secure modulus length for modular exponentiation so that finding discrete log is computationaly impossible?
1
vote
1answer
88 views
How large should a Diffie-Hellman p be if the messages are encrypted?
How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted.
If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
1
vote
2answers
180 views
Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
I am trying to find the protocol with the least overhead, which still meets the following requirements:
Server Authentication of server identity to client. The client has an authentic copy of the ...
0
votes
1answer
80 views
Can one detect if two pairs of elements in Zp have the same exponential relation?
Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime).
Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that:
$y_1 = x_1^{r_1} \pmod p$
$y_2 = ...
5
votes
3answers
214 views
Finding roots in $\mathbb{Z}_p$
Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$?
$n\in \mathbb{N}$
$a\in\mathbb{Z}_p$
$p$ is a large prime number
Note that:
By efficient I ...
0
votes
0answers
63 views
Use curve25519 for ElGamal crypto
DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
0
votes
1answer
119 views
Digital signatures in SSL/TLS-like protocols
The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
0
votes
1answer
118 views
Request for 1024-bit primes $p$ , subgroup $q$ and subgroup generator $g$
I need to find a prime $p$ of $1024$ bits with a $160$ bit sub group size $q$, such that $q|p-1$ , and $g$ is the generator of the sub group size $q$.
I'm looking for the numeric values of $p$ , $q$ ...
4
votes
1answer
210 views
Why is Diffie-Hellman considered in the context of public key cryptography?
In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography".
As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
-1
votes
1answer
214 views
ECDH VS. DH benchmarking in JAVA
So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key.
I compare the time it takes to generate:
...
3
votes
1answer
105 views
How can we determine if two discrete logarithms are equal?
Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
7
votes
2answers
308 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
2
votes
1answer
77 views
What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?
I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
3
votes
1answer
147 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
0
votes
1answer
111 views
Diffie-Hellman is Post-quantum secured?
If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
5
votes
2answers
167 views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST ...
2
votes
1answer
201 views
Explanation of the Decision Diffie Hellman (DDH) problem.
I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
0
votes
1answer
144 views
Ways to protect flash player against MITM diffie hellman
We have a server, which sends content encrypted with AES128 or RC4 to a flash client over an insecure HTTP channel. The encryption key is negotiated using Diffie Hellman.
The problem:
Diffie ...
5
votes
2answers
201 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
5
votes
2answers
2k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
2
votes
1answer
101 views
Safety of a pre-keyed DH-Key Exchange
Asuming this scenario:
Bob and Alice each have the public key of the other party for a D-H function and want to exchange data.
Now, if they each generate their shared secret, is it safe to assume ...
6
votes
2answers
202 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
0
votes
1answer
389 views
BouncyCastle Elliptic Curve implementation
I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).
...
7
votes
3answers
2k views
Can one generalize the Diffie-Hellman key exchange to three or more parties?
Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties?
I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
0
votes
1answer
149 views
How can the Diffie-Hellman key exchange be extended to three parties? [duplicate]
Possible Duplicate:
Can one generalize the Diffie-Hellman key exchange to three or more parties?
How can Alice, Bob, and Charlie share a common secret key using an extended version of the ...
0
votes
1answer
99 views
Zero Knowledge auth schemes with weak secret
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no ...
0
votes
0answers
249 views
Diffie hellman key exchange on elliptic curve over an extension field [closed]
I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field ...
6
votes
1answer
819 views
why do we need Diffie Hellman?
my question from stackoverflow: http://stackoverflow.com/questions/11374592/why-do-we-need-diffie-hellman
Diffie–Hellman offers secure key exchange only if sides are authenticated. for ...
3
votes
1answer
152 views
Does Identity-Based Encryption actually solve any problem?
Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
2
votes
1answer
199 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
2
votes
1answer
93 views
How does DJB's nistp224 manage to fit compressed points into 224 bits?
DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.
To the best of my ...
0
votes
1answer
268 views
How do I generate a session key using the Diffie Hellman algorithm?
How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
3
votes
3answers
398 views
What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?
How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related?
From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
4
votes
1answer
437 views
advantages of a static ECDH key
What are the advantages of using static-ephemeral ECDH over ephemeral-ephemeral ECDH?
1
vote
2answers
212 views
My custom handshake
I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements:
Requirements:
The handshake ...
3
votes
1answer
547 views
Trouble with diffie-hellman groups
Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
5
votes
1answer
253 views
How should I check the received ephemeral Diffie-Hellman public keys?
In my application I'm doing a DH key exchange, where both sides generate their
own ephemeral key. No static keys are used. I am trying to make my
application resistant against an active attack and ...
3
votes
3answers
396 views
Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?
I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was ...
7
votes
7answers
3k views
Is Diffie-Hellman mathematically the same as RSA?
Is the Diffie-Hellman key exchange the same as RSA?
Diffie Hellman allows key exchange on a observed wire – but so can RSA.
Alice and Bob want to exchange a key – Big brother is watching everything.
...
2
votes
3answers
105 views
Is the $\ell$-Diffie Hellman Inversion easy when g is known?
From here they define the $\ell$-Diffie Hellman inversion problem as:
Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$
Would this problem become easy if the generator $g$ is ...
3
votes
1answer
553 views
How large should a Diffie-Hellman p be?
In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
2
votes
2answers
154 views
Is EKE attackable by a brute-force password search?
So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz.
So what I'm ...
5
votes
1answer
173 views
Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says:
The strength of a key ...
