The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms

3
votes
1answer
257 views

Why use Needham-Schroeder if we have Diffie-Hellman?

If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?
1
vote
1answer
469 views

In this example, which is a premaster secret, and which is a master secret?

In the context of this data, as shown in the image below, which one is a pre-master-secret and which one is a master-secret. It looks to me as if the final value of 2, for Alice and Bob is a ...
0
votes
1answer
307 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
1
vote
1answer
144 views

Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
1
vote
1answer
199 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
3
votes
2answers
251 views

Should I bother implementing DH + AES, or leave it to a library like Crypto++

I'm making a C++ back end for an application that'll heavily rely on AES-256 and DH. Should I trust third party libraries, or spend (lots of) time to learn about cryptographic implementation and write ...
4
votes
1answer
277 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
3
votes
1answer
133 views

Security Level Estimate when Cascading/Compositing Ciphers?

Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not ...
7
votes
2answers
2k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
3
votes
2answers
143 views

Diffie-Hellman insecure on addition modulo $n$

Assume that the group $G$ is the set $\mathbb{Z}_{n} = \{0,\ldots, n-1\}$ for a 1024 bit integer and $+$ is addition modulo $n$. Then why would Diffie-Hellman key exchange in this group be insecure?
1
vote
1answer
156 views

Diffie-Hellman on additive group

Given the finite cyclic, additive group (G, +), with |G| = n and generator = g, what are the computations and exchanged messages for Diffie-Hellman? What I tried myself: Alice chooses a private $a$ ...
4
votes
2answers
4k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
3
votes
1answer
104 views

Diffie-Hellman for Encryption

In learning how DH works for cryptography applications, I'm coming across some confusing language. For starters, most of the time DH is discussed in the context of "generating" their shared secret. ...
1
vote
0answers
91 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
1
vote
1answer
209 views

How should I manage Diffie-Hellman parameters on a Web Server?

Is there a best practice for Diffie-Hellman parameters (p, g, and q) used on a web server? The server is using ephemeral keys, but should the parameters be rotated on a regular basis? Is it OK for ...
1
vote
0answers
173 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
1
vote
1answer
124 views

Efficient parameters for group Diffie-Hellman

I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. ...
1
vote
1answer
157 views

Why routers don't just use Diffie-Hellman protocol?

Routers could just use Diffie-Hellman protocol with any computer who tries to connect to that router. Then it would be impossible to eavesdrop for anyone. Only router and computer would know the ...
0
votes
1answer
235 views

modfied man in the middle attack diffie hellman

I have been given a problem in preparation for my cryptography final that I'm not sure how to solve. It asks me to suppose a scenario where instead of where an attacker would intercept some message ...
7
votes
1answer
254 views

Are there any differences in operation between existing Diffie-Hellman specifications?

Are there any differences in operation between existing Diffie-Hellman specifications, especially those within the RSA PKCS#3, ANSI X9.42 and RFC 2631 standards?
-1
votes
1answer
107 views

Can Diffie-Hellman generate values in a specified range?

Is there any way to generate values only between $0$ and $255$ with the Diffie-Hellman method? I need to create keys for communication algorithms with $32$ and $16$ numbers between that range. The ...
1
vote
1answer
178 views

Are there any protocols that are truly secure from active and passive MITM attacks?

Are there are any cryptographic protocols or algorithms that can prevent active MITM attacks or interference when initiating a new connection to a server or someone you have not exchange keys with ...
1
vote
0answers
174 views

Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
3
votes
1answer
163 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
2
votes
1answer
227 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
1
vote
1answer
229 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
7
votes
1answer
1k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
0
votes
2answers
295 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
1
vote
2answers
113 views

Self authenticating tamper resistant first meetings

I'm not sure what the precise words I am looking for are so I apologize if there is a better way to phrase this. What I am thinking of is ways to transfer an identity in a way that it is tamper ...
3
votes
1answer
458 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
1
vote
0answers
130 views

Career advice for our readers [closed]

I am a first year math PhD student with work experience and an MS in math. Do you have any advice regarding internships involved with cryptography and other mathematics other than the NSA? Thanks.
2
votes
1answer
285 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
0
votes
2answers
139 views

Key Refresh in Diffie-Hellman

Assume the case, that two participants have agreed on a key $K=g^{ab} \mod p$ via Diffie Hellman. I have the need to change the key every now and then. The first idea I had was to simply initiate a ...
8
votes
1answer
2k views

Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ...
6
votes
2answers
739 views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
2
votes
1answer
238 views

Does SRP reduce to DH key echange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
3
votes
1answer
107 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
4
votes
1answer
1k views

Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
6
votes
1answer
237 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
4
votes
1answer
105 views

Hardness of CDH in different groups

What is the difference of the CDH problem in different groups? In particular, given a group $\mathbb{G}_1$ of order $q$ that is a subgroup of $\mathbb{Z}_q^*$, $q$ prime, and another group ...
2
votes
1answer
165 views

Is generating public key inevitably slow in classic Diffie-Hellman if the private key is large?

Let's say I pick a 3000+ bit prime $p$ for which I also know that $q = (p - 1) / 2$ is a prime. If I've understood correct, then I can pick pretty much any $g$. Is generating $g^x$ now inevitably ...
2
votes
1answer
142 views

Using plain Diffe-Hellman for server authentication with known public key

Other considerations aside, is it possible to use DH with an established public key (together with fixed g, p, q) to safely authenticate a server instead of using some signing algorithm? In other ...
1
vote
0answers
115 views

openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
1
vote
2answers
1k views

ECDH VS. DH benchmarking in JAVA

So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key. I compare the time it takes to generate: ...
11
votes
2answers
11k views

What's the fundamental difference between Diffie-Hellman and RSA?

What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
4
votes
2answers
550 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
1
vote
1answer
146 views

What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
0
votes
1answer
142 views

Can one detect if two pairs of elements in Zp have the same exponential relation?

Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime). Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that: $y_1 = x_1^{r_1} \pmod p$ $y_2 = ...
7
votes
3answers
4k views

What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least ...
3
votes
1answer
170 views

Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...