The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

learn more… | top users | synonyms (1)

0
votes
0answers
15 views

How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
1
vote
2answers
25 views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
0
votes
0answers
30 views

Saving energy when using public key algorithms by using block ciphers? [on hold]

When using public key algorithms like RSA, Diffie- hellman and Elgamel, how can one predict/prove/argue that these security protocols are energy efficient by using block ciphers?
0
votes
1answer
33 views

Confusion regarding computing Multiplicative Inverse Modulo P?

May be a silly doubt, please rectify my confusion regarding below problem: For concreteness assume $g=2, p=11, a=6$ and $x=9$ $$A = g^a \bmod p = 2^6 \bmod 11 = 9$$ $$X = g^x \bmod p = 2^9 \bmod 11 ...
12
votes
1answer
4k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
2
votes
2answers
32 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote ...
4
votes
4answers
3k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
1
vote
1answer
22 views

Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
2
votes
0answers
32 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
4
votes
1answer
84 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
1
vote
1answer
47 views

variant of Diffie–Hellman key exchange protocol

Motivation Consider the following variant of Diffie-Hellman key exchange protocol for two parties: Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$ Alice samples $a$ ...
-1
votes
1answer
25 views

How ECDH algorithm selects modulus value?

I am curious to know how an ECDH algorithms select a module value, if both ends A & B can generate same shared key using the public key of each other ? If I understood DH correctly, both A and B ...
1
vote
0answers
30 views

Small subgroup attack on Diffie-Hellman

I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime, so the ...
1
vote
1answer
74 views

Session key Exchange, some doubt

I have to find a solution to this problem: I have a network composed by 1 server and some client. The server has a couple of keys (public and private) and it shares a secret key with each client. My ...
1
vote
1answer
73 views

Proving security of TLS handshake with ProVerif

Background For my dissertation I am working on an application protocol for which I require a TLS session. I am looking to achieve Perfect Forward Secrecy, which means I have selected ephemeral ...
5
votes
1answer
182 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
1
vote
1answer
50 views

Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session ...
1
vote
1answer
51 views

Factors of the group order to secure against Pohlig-Hellman

I am looking into the security of Diffie-Hellman and the discrete log in general. To make sure an attacker can not use Pohlig-Hellman to solve the discrete log quickly we need to make sure that the ...
1
vote
1answer
38 views

ssh-keygen DH Primality Testing

I'm pretty familiar with using ssh-keygen to create groups that go in the /etc/ssh/moduli file for the Diffie-Hellman Group Exchange in openssh. Reading over the man page, it says "By default, each ...
-2
votes
1answer
79 views

Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem

Let $q$ prime number, $G$ a cyclic group with order $q$ and let $g \in G$ be a generator of $G$. Suppose that you have an algorithm $A$ who takes input the element $g^a$ of $G$ and gives as output the ...
9
votes
1answer
4k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
1
vote
1answer
525 views

Static DH/Static ECDH certificate using OpenSSL

I've been searching for some time and have found no way to create a working certificate and private key pair with a DH or ECDH public key using OpenSSL. Once I do this, I'd like to sign it with an RSA ...
1
vote
3answers
106 views

curious DHE implementation for key exchange

I have made some reverse engineering on proprietary software and came up with some DHE algorithm that works like this: First and foremost, the client and the server shares some public parameters (g, ...
1
vote
0answers
46 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
2
votes
1answer
191 views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
5
votes
1answer
149 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
1
vote
2answers
2k views

ECDH VS. DH benchmarking in JAVA

So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key. I compare the time it takes to generate: ...
9
votes
1answer
2k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
0
votes
1answer
70 views

Why we need ECDSA when we have ECDH?

ECDSA and ECDH give us the following methods: ...
2
votes
1answer
380 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
1
vote
0answers
47 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
4
votes
1answer
336 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
1
vote
2answers
477 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
2
votes
1answer
79 views

Diffe-Helman Exchange result is always 1

I watched a video on Khan Academy explaining the Diffe-Hellman exchange. When I try to do an example problem, I get 1 all the time. Does the generator and prime modulus (or base on Wikipedia) have to ...
6
votes
1answer
850 views

Diffie-Hellman Parameter Check (when g = 2, must p mod 24 == 11?)

I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). When I test some of the group ...
0
votes
1answer
96 views

Diffie Hellman Exponentiation Implementation Problem

im trying to work on key agreement schemas on embeded systems. for diffie hellman, ive written a 256 bit multiplication, on AVR core it takes about 2 seconds on 1Mhz frequency, lets say my algorithm ...
0
votes
0answers
83 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
1
vote
1answer
35 views

What is a man-in-the-middle attack (for instance in Diffie-Hellman)?

I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is ...
1
vote
3answers
149 views

DH and PKI for KeyExchange

My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. ...
2
votes
1answer
205 views

ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two ...
1
vote
1answer
262 views

Use curve25519 for ElGamal crypto [duplicate]

DJB described curve25519 in his paper which can be found here (PDF). It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that Discrete Log is supposed to be hard on ...
2
votes
1answer
203 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
5
votes
1answer
1k views

Why elgamal is still discussed

As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it ...
1
vote
1answer
210 views

Is 256 a reasonable length for a Diffie-Hellman safe prime?

There's a program that uses the following OpenSSL function... DH_generate_parameters(256, 5, NULL, NULL) ...to create DH parameters which are later used for ...
0
votes
1answer
25 views

SSH rekey security implications

When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing ...
-2
votes
1answer
22 views

Relationship between an elements order and the DLP [closed]

How can I use these properties to attack the DHKE? I know that the order of $a$ is always $2$ for $a = P - 1$ in $Z_p$. The subgroups generated by a will be $\{1,a\}$.
4
votes
1answer
588 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
1
vote
1answer
67 views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
3
votes
1answer
101 views

Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?

Let $G$ be a cyclic multiplicative group of order $n$. Let $g$ be a (public) generator of $G$. The Diffie-Hellman (DH) problem asks: Given $g^x, g^y\in G$ for $x, y\in \mathbb{Z}^*_n$, to compute ...
1
vote
1answer
43 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...