The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms

12
votes
2answers
1k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
2
votes
1answer
127 views

What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
3
votes
1answer
263 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
2
votes
1answer
486 views

Diffie-Hellman is Post-quantum secured?

If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
6
votes
2answers
431 views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
4
votes
1answer
1k views

Explanation of the Decision Diffie Hellman (DDH) problem.

I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
0
votes
1answer
260 views

Ways to protect flash player against MITM diffie hellman

We have a server, which sends content encrypted with AES128 or RC4 to a flash client over an insecure HTTP channel. The encryption key is negotiated using Diffie Hellman. The problem: Diffie ...
4
votes
1answer
134 views

Safety of a pre-keyed DH-Key Exchange

Asuming this scenario: Bob and Alice each have the public key of the other party for a D-H function and want to exchange data. Now, if they each generate their shared secret, is it safe to assume ...
6
votes
2answers
603 views

Why do public keys need to be validated?

For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
2
votes
1answer
1k views

BouncyCastle Elliptic Curve implementation

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve). ...
11
votes
3answers
4k views

Can one generalize the Diffie-Hellman key exchange to three or more parties?

Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties? I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
1
vote
1answer
798 views

How can the Diffie-Hellman key exchange be extended to three parties? [duplicate]

Possible Duplicate: Can one generalize the Diffie-Hellman key exchange to three or more parties? How can Alice, Bob, and Charlie share a common secret key using an extended version of the ...
0
votes
1answer
166 views

Zero Knowledge auth schemes with weak secret

In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no ...
1
vote
0answers
339 views

Diffie hellman key exchange on elliptic curve over an extension field [closed]

I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field ...
7
votes
1answer
3k views

why do we need Diffie Hellman?

my question from stackoverflow: http://stackoverflow.com/questions/11374592/why-do-we-need-diffie-hellman Diffie–Hellman offers secure key exchange only if sides are authenticated. for ...
4
votes
1answer
259 views

Does Identity-Based Encryption actually solve any problem?

Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
3
votes
1answer
407 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
5
votes
1answer
165 views

How does DJB's nistp224 manage to fit compressed points into 224 bits?

DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve. To the best of my ...
1
vote
2answers
300 views

My custom handshake

I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements: Requirements: The handshake ...
5
votes
1answer
1k views

Trouble with diffie-hellman groups

Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
8
votes
1answer
833 views

How should I check the received ephemeral Diffie-Hellman public keys?

In my application I'm doing a DH key exchange, where both sides generate their own ephemeral key. No static keys are used. I am trying to make my application resistant against an active attack and ...
6
votes
3answers
843 views

Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?

I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was ...
5
votes
3answers
169 views

Is the $\ell$-Diffie Hellman Inversion easy when g is known?

From here they define the $\ell$-Diffie Hellman inversion problem as: Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$ Would this problem become easy if the generator $g$ is ...
5
votes
1answer
2k views

How large should a Diffie-Hellman p be?

In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
2
votes
2answers
298 views

Is EKE attackable by a brute-force password search?

So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz. So what I'm ...
5
votes
1answer
307 views

Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?

Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says: The strength of a key ...
3
votes
1answer
653 views

Generalizing the conversion of Diffie-Hellman to El Gamal

How can we generalize the conversion of Diffie-Hellman to El Gamal public-key encryption scheme? The goals is to be eventually able to show that any 2-round key-exchange protocol can be converted into ...
4
votes
1answer
156 views

Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
26
votes
1answer
3k views

Does the generator size matter in Diffie-Hellman?

For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
17
votes
3answers
3k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...