The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms (1)

3
votes
1answer
141 views

Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?

Let $G$ be a cyclic multiplicative group of order $n$. Let $g$ be a (public) generator of $G$. The Diffie-Hellman (DH) problem asks: Given $g^x, g^y\in G$ for $x, y\in \mathbb{Z}^*_n$, to compute $g^{...
1
vote
1answer
107 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
0
votes
0answers
78 views

Solving discrete logarithm when p is not a safe prime

If you have the cyclic group of integers modulo $p$, where $p$ is not a safe prime, as well as a generator $g$ with which for all factors $q$ of $(p-1)$, $g^{(p-1)/q} \ne 1$, This answer says that ...
0
votes
0answers
79 views

Property of Multiplicative group of integers mod n

While practising on paper I've realized of a property of multiplicative group of integers mod $n$. First, let's define $G$ being $p$ a prime and $g$ a primitive root mod n or a generator of a ...
1
vote
1answer
349 views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
1
vote
0answers
136 views

My attempt of combining socialist millionaire and Diffie-Hellman. Is it any good?

I've come up with an algorithm to solve the socialist millionaire problem, but I'm not sure if the algorithm is secure. I wasn't able to find any flaw in it, but it seems too simple to be secure, so I'...
1
vote
2answers
42 views

Can a TLS client perform any DH regeneration?

I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a ...
12
votes
1answer
259 views

Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
4
votes
1answer
75 views

possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
4
votes
1answer
227 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
7
votes
1answer
321 views

Logjam: “composite order subgroups” explained for TLS developers and system admins?

I have read the recent logjam paper Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. On page 11 in the Recommendations section, they state: ...
0
votes
2answers
50 views

what is recommended x length in Diffie Hellman algorithm

According to rfc documents http://tools.ietf.org/html/rfc2412#appendix-E.2 & http://tools.ietf.org/html/rfc3526#section-3, it has defined the prime and the <...
0
votes
2answers
213 views

DH with AES - is that an acceptable security scheme over UPnP?

I'm trying to devise a good security scheme to protect comms over Wi-Fi. Right now, I have 2 devices that already communicate via UPnP but I need to secure this communication. I've come up with this: ...
2
votes
1answer
137 views

Understanding Diffie-Hellman Key Exchange [closed]

Help me understand the Diffie-Hellman Key Exchange From what I understand: Agreed upon numbers: Both parties agree on the value of a large prime number $p$ and a generator $g$. The users each ...
1
vote
2answers
223 views

Why does Diffie-Hellman need be a cyclic group?

Why is Diffie-Hellman defined on a cyclic group? Doesn't it work for any commutative operation which the inverse is hard to find? Say Alice and Bob agree in a public prime $c$ and both choose a ...
0
votes
2answers
60 views

Why does spiped use both nonces and ephemeral keys?

Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy. The protocol is summarized in the project'...
4
votes
2answers
463 views

Does SRP reduce to DH key exchange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
10
votes
1answer
2k views

How does ECDH arrive on a shared secret?

I read a brilliant, three part article on Elliptic Curve cryptography (one, two, three). It was able to explain Elliptic Curves to me in a way that didn't require a math degree to understand. The ...
1
vote
1answer
80 views

DHKE choice of private keys

In some literature it is written that the private key should be chosen random from {2,3, ..., p-1} and in some it says {2,3, ..., p-2} I guess p-1 is a weak private key, but why is that so? The ...
1
vote
1answer
74 views

Rationale of “r” AES key use in OTR version 3 AKE protocol?

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy I am a ...
2
votes
1answer
478 views

Why is diffie-hellmangroup1-sha1 used instead of diffie-hellman?

For SSH why is diffie-hellmangroup1-sha1 used instead of just diffie-hellman? In other words, why is the hash function used?
1
vote
1answer
299 views

How to encypt/decrypt messages after ECDH key agreement

I am using Diffie-Helman key exchange to generate the shared secret. But how will can a message be encrypted using this shared key?
3
votes
1answer
315 views

Is only one shared secret generated by ECDH per key pair?

I'm confused about ECDH. Using their public keys and private keys, two entities can arrive on a shared secret. But from the equations I've seen, it looks like ONLY the numbers present in their key ...
22
votes
3answers
32k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
0
votes
1answer
68 views

Workaround to implementing Forward Secrecy

In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as ...
2
votes
3answers
162 views

How does $g$ being a generator imply Diffie-Hellman's correctness?

In the Diffie-Hellman protocol for key exchange over an unsecured channel, we choose $p$ and $g$, where $g$ is a generator of $\mathbf{Z}_p^*$. However I want to know why this assumption makes the ...
0
votes
1answer
80 views

Requirement for the exponent generation during DH protocol [duplicate]

The setting is classic DH protocol. Alice computes $A = g^a \bmod p$. Alice then sends $A$ to Bob. Then Bob will send $B = g^b \bmod p$ to Alice. Are there any requirements for the values $a$ and $b$...
7
votes
1answer
183 views

Malicious DH groups

Can an attacker construct a DH group, large enough to be considered secure (say, a modulus of 2048-bits), such that the group appears safe, but the attacker is able to solve the DLP in the group ...
1
vote
1answer
223 views

Diffie-Hellman Application

Alice and Bob want to perform a Diffie-Hellman key exchange using the group $G$, a primitive root $g$, Alice’s secret key $k_A$ and Bob’s secret key $k_B$. In each case below compute the element of $G$...
21
votes
3answers
5k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
2
votes
0answers
76 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
7
votes
1answer
435 views

curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
3
votes
0answers
148 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem to ...
0
votes
1answer
84 views

Post-quantum hybrid encryption

Assume the following simplified protocol: seed = curve25519SharedKey(theirPublicKey, myPrivateKey) sharedKey = scrypt(seed, salt, sufficientlyHardWorkFactors...) cipherText = aes256(sharedKey, ...
3
votes
3answers
354 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function? [duplicate]

I know: Never do your own crypto. But this question is just theoretical. Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash ...
-1
votes
1answer
105 views

Why is g is less than p in Diffie-Hellman?

In non-authenticated DH, p and g are made as public record. p needs to be a large prime number and g should be smaller than p. Why does g need to be smaller than p?
1
vote
1answer
200 views

Building a pad for OTP on-the-fly with Diffie-Hellman

Through repeated DH attempts, could Alice and Bob build a large random key for use as a one-time pad? My intuition is that this protocol would be as hard as breaking DH (discrete logarithm).
1
vote
2answers
215 views

DHE key exchange. Is it really secure?

Context I recently came across a video on the net showing the process of key exchange in Diffie Hellmann. Alice and Bob want to communicate. Eve is the (wo)man in the middle. This video is the ...
0
votes
1answer
236 views

Addition / Multiplication modulo 13

I am currently studying Diffie-Helman protocol. In my lecture notes I have a generator g=2 and I'm in group $Z_{13}^*$ . There I calculate a remainder cycle from 1 to 12 with $r =g^i \mod 13 \forall ...
2
votes
2answers
129 views

How well does breaking multiple DH key exchanges over the same group scale?

Suppose you are running a server with the Diffie-Hellman parameters (so the group G and generator g) generated once. There are ...
7
votes
1answer
311 views

Implementation and Testing of SRP-6a

I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...
12
votes
3answers
8k views

How does one calculate a primitive root for Diffie-Hellman?

In the Diffie-Hellman key exchange, one of the steps involves calculating a primitive root of a prime number $p$. How would one go about doing so, considering that $p$ could be very large? Is there ...
1
vote
2answers
288 views

Can DH_anon really be exploited by an attacker?

General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run ...
6
votes
1answer
487 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
1
vote
1answer
77 views

Can Diffie-Hellman be scaled up or force-multiplied?

I'm not too familiar with the math involved with the exchange of keys, I've read it over several times, but math isn't my strong point. My understanding is that smart people are hard at work to ...
-1
votes
1answer
93 views

How to use the key from a Diffie Hellman exchange? [closed]

I watched a YouTube video about Diffie-Hellman called "Diffie-Hellman Key Exchange", and it said after doing some modulo operations with the public modulus and generator and the random private numbers,...
6
votes
2answers
406 views

CDH problem and Square-DH problem

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $CDH(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ uniformly at ...
1
vote
0answers
60 views

Are there any obvious techncial faults in F. Ruiz's 2013 URSA javascript cryptography? [closed]

The link to the cryptography is here: http://prgomez.com/ursa/ I have found the following simple javascript system of encryption/decryption portable and easy to use for emails and messaging sites, ...
8
votes
1answer
163 views

Proof of Communication

I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received. Ideally this would take the form of a public-key signature of the block $X$ ...
3
votes
2answers
371 views

Diffie–Hellman Ephemerality Nomenclature

Below is a short excerpt of available DH cipher suites available on a machine. I understand EDH is ephemeral DH, and that ECDH is for Elliptic-Curve DH which is computationally faster. ECDHE is both ...