The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms

0
votes
1answer
244 views

modfied man in the middle attack diffie hellman

I have been given a problem in preparation for my cryptography final that I'm not sure how to solve. It asks me to suppose a scenario where instead of where an attacker would intercept some message ...
0
votes
1answer
493 views

Diffie-Hellman Secret Exponent Size and Shared Secret Usage [closed]

I'm developing my own protocol and I'll use Diffie-Hellman to achieve PFS. It will work in this way: The symmetric encryption algorithm will be AES_256_CBC. The DH parameters will be: P: a 2048-bit ...
-1
votes
1answer
111 views

Can Diffie-Hellman generate values in a specified range?

Is there any way to generate values only between $0$ and $255$ with the Diffie-Hellman method? I need to create keys for communication algorithms with $32$ and $16$ numbers between that range. The ...
1
vote
1answer
180 views

Are there any protocols that are truly secure from active and passive MITM attacks?

Are there are any cryptographic protocols or algorithms that can prevent active MITM attacks or interference when initiating a new connection to a server or someone you have not exchange keys with ...
7
votes
1answer
257 views

Are there any differences in operation between existing Diffie-Hellman specifications?

Are there any differences in operation between existing Diffie-Hellman specifications, especially those within the RSA PKCS#3, ANSI X9.42 and RFC 2631 standards?
0
votes
1answer
315 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
1
vote
1answer
242 views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
7
votes
2answers
2k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
1
vote
1answer
204 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
1
vote
0answers
178 views

Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
2
votes
1answer
230 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
0
votes
2answers
336 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
3
votes
1answer
164 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
1
vote
2answers
114 views

Self authenticating tamper resistant first meetings

I'm not sure what the precise words I am looking for are so I apologize if there is a better way to phrase this. What I am thinking of is ways to transfer an identity in a way that it is tamper ...
3
votes
2answers
258 views

Is prime regeneration necessary for every new session using a Diffie-Hellman key exchange?

As I understand it, bruteforcing a Diffie-Hellman generated secret key takes $P-1$ attempts to crack the shared secret, where $P$ is a very large prime used for modulus. If your $P$ is quite large, ...
3
votes
1answer
465 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
1
vote
0answers
132 views

Career advice for our readers [closed]

I am a first year math PhD student with work experience and an MS in math. Do you have any advice regarding internships involved with cryptography and other mathematics other than the NSA? Thanks.
1
vote
1answer
178 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
2
votes
1answer
308 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
0
votes
2answers
143 views

Key Refresh in Diffie-Hellman

Assume the case, that two participants have agreed on a key $K=g^{ab} \mod p$ via Diffie Hellman. I have the need to change the key every now and then. The first idea I had was to simply initiate a ...
8
votes
1answer
2k views

Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ...
6
votes
2answers
771 views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
3
votes
1answer
112 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
4
votes
2answers
4k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
4
votes
1answer
1k views

Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
4
votes
1answer
105 views

Hardness of CDH in different groups

What is the difference of the CDH problem in different groups? In particular, given a group $\mathbb{G}_1$ of order $q$ that is a subgroup of $\mathbb{Z}_q^*$, $q$ prime, and another group ...
6
votes
1answer
427 views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
2
votes
1answer
166 views

Is generating public key inevitably slow in classic Diffie-Hellman if the private key is large?

Let's say I pick a 3000+ bit prime $p$ for which I also know that $q = (p - 1) / 2$ is a prime. If I've understood correct, then I can pick pretty much any $g$. Is generating $g^x$ now inevitably ...
3
votes
3answers
230 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
2
votes
0answers
184 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
1
vote
0answers
116 views

openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
2
votes
2answers
2k views

How to find generator $g$ in a cyclic group?

As generator $g$ is use in DH how to find combination of prime $p$ and $g$? eg: if we choose $p=23$ its generator is $7$ (given in book) how to find it?
2
votes
1answer
143 views

Using plain Diffe-Hellman for server authentication with known public key

Other considerations aside, is it possible to use DH with an established public key (together with fixed g, p, q) to safely authenticate a server instead of using some signing algorithm? In other ...
9
votes
4answers
506 views

Authenticated DH, what protocols are secure?

I read about STS + variants being insecure in the SIGMA paper, which then proposes SIGMA as a replacement. Are the SIGMA variants still considered secure or are there some other protocol that's ...
6
votes
1answer
241 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
20
votes
3answers
24k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
8
votes
1answer
226 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
1
vote
1answer
149 views

What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
2
votes
2answers
258 views

Does SRP reduce to DH key echange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
2
votes
1answer
421 views

How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
3
votes
1answer
178 views

Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
3
votes
1answer
117 views

Potential vulnerability in DH key selection - am I understanding this right?

I'm reading through a DH implementation, and I think I found a potential hole. Public $p$ and $g$ values are properly selected. A candidate secret value $\bar a$ is pseudo-randomly selected such ...
2
votes
1answer
530 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
1
vote
0answers
101 views

Secure modulus length for Diffie-Hellman [duplicate]

What is secure modulus length for modular exponentiation so that finding discrete log is computationaly impossible?
2
votes
1answer
237 views

How large should a Diffie-Hellman p be if the messages are encrypted?

How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted. If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
4
votes
2answers
562 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
0
votes
1answer
142 views

Can one detect if two pairs of elements in Zp have the same exponential relation?

Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime). Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that: $y_1 = x_1^{r_1} \pmod p$ $y_2 = ...
1
vote
0answers
218 views

Use curve25519 for ElGamal crypto

DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
6
votes
3answers
579 views

Finding roots in $\mathbb{Z}_p$

Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$? $n\in \mathbb{N}$ $a\in\mathbb{Z}_p$ $p$ is a large prime number Note that: By efficient I ...
2
votes
1answer
397 views

Digital signatures in SSL/TLS-like protocols

The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...