The most famous key exchange algorithm with perfect forward-secrecy.
20
votes
1answer
1k views
Does the generator size matter in Diffie-Hellman?
For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
11
votes
3answers
1k views
For Diffie-Hellman, must g be a generator?
Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator?
Recall the mathematics of Diffie-Hellman:
Given public ...
7
votes
7answers
3k views
Is Diffie-Hellman mathematically the same as RSA?
Is the Diffie-Hellman key exchange the same as RSA?
Diffie Hellman allows key exchange on a observed wire – but so can RSA.
Alice and Bob want to exchange a key – Big brother is watching everything.
...
7
votes
3answers
2k views
Can one generalize the Diffie-Hellman key exchange to three or more parties?
Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties?
I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
7
votes
2answers
314 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
7
votes
3answers
3k views
How does one calculate a primitive root for Diffie-Hellman?
In the Diffie-Hellman key exchange, one of the steps involves calculating a primitive root of a prime number $p$. How would one go about doing so, considering that $p$ could be very large?
Is there ...
6
votes
1answer
842 views
why do we need Diffie Hellman?
my question from stackoverflow: http://stackoverflow.com/questions/11374592/why-do-we-need-diffie-hellman
Diffie–Hellman offers secure key exchange only if sides are authenticated. for ...
6
votes
2answers
202 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
6
votes
2answers
2k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
5
votes
3answers
216 views
Finding roots in $\mathbb{Z}_p$
Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$?
$n\in \mathbb{N}$
$a\in\mathbb{Z}_p$
$p$ is a large prime number
Note that:
By efficient I ...
5
votes
2answers
169 views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST ...
5
votes
2answers
203 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
5
votes
1answer
259 views
How should I check the received ephemeral Diffie-Hellman public keys?
In my application I'm doing a DH key exchange, where both sides generate their
own ephemeral key. No static keys are used. I am trying to make my
application resistant against an active attack and ...
5
votes
1answer
174 views
Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says:
The strength of a key ...
5
votes
2answers
833 views
Why can't Diffie-Hellman be used for signing?
I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
4
votes
1answer
440 views
advantages of a static ECDH key
What are the advantages of using static-ephemeral ECDH over ephemeral-ephemeral ECDH?
4
votes
2answers
771 views
How to calculate the time it'll take to crack RSA or DH?
Sometimes the easiest way to describe security of a type of cryptography is to say that "the time it takes to solve for an x-bit key would be y years". How would one go about doing such a calculation ...
4
votes
1answer
220 views
Why is Diffie-Hellman considered in the context of public key cryptography?
In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography".
As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
3
votes
3answers
397 views
Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?
I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was ...
3
votes
3answers
405 views
What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?
How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related?
From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
3
votes
3answers
929 views
What should be the size of a Diffie-Hellman private key?
I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman).
The RFC documents state:
The private values $a$ and $b$ SHOULD be at least ...
3
votes
1answer
573 views
How large should a Diffie-Hellman p be?
In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
3
votes
1answer
105 views
How can we determine if two discrete logarithms are equal?
Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
3
votes
1answer
155 views
Does Identity-Based Encryption actually solve any problem?
Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
3
votes
1answer
54 views
Chosen ciphertext insecurity in an ElGamal variant
I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
3
votes
1answer
554 views
Trouble with diffie-hellman groups
Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
3
votes
1answer
108 views
Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?
I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
3
votes
1answer
148 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
2
votes
1answer
88 views
Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?
I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
2
votes
3answers
105 views
Is the $\ell$-Diffie Hellman Inversion easy when g is known?
From here they define the $\ell$-Diffie Hellman inversion problem as:
Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$
Would this problem become easy if the generator $g$ is ...
2
votes
2answers
155 views
Is EKE attackable by a brute-force password search?
So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz.
So what I'm ...
2
votes
1answer
93 views
How does DJB's nistp224 manage to fit compressed points into 224 bits?
DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.
To the best of my ...
2
votes
1answer
71 views
Potential vulnerability in DH key selection - am I understanding this right?
I'm reading through a DH implementation, and I think I found a potential hole.
Public $p$ and $g$ values are properly selected.
A candidate secret value $\bar a$ is pseudo-randomly selected such ...
2
votes
1answer
77 views
What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?
I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
2
votes
1answer
209 views
Explanation of the Decision Diffie Hellman (DDH) problem.
I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
2
votes
1answer
45 views
How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?
I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
2
votes
1answer
102 views
Safety of a pre-keyed DH-Key Exchange
Asuming this scenario:
Bob and Alice each have the public key of the other party for a D-H function and want to exchange data.
Now, if they each generate their shared secret, is it safe to assume ...
2
votes
1answer
320 views
Generalizing the conversion of Diffie-Hellman to El Gamal
How can we generalize the conversion of Diffie-Hellman to El Gamal public-key encryption scheme? The goals is to be eventually able to show that any 2-round key-exchange protocol can be converted into ...
2
votes
1answer
202 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
1
vote
1answer
92 views
How large should a Diffie-Hellman p be if the messages are encrypted?
How large should the prime $p$ and generator $g$ values be in a Diffie-Hellman handshake if the messages are encrypted.
If the key that encrypted the Diffie-Hellman messages becomes compromised, ...
1
vote
2answers
216 views
My custom handshake
I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements:
Requirements:
The handshake ...
1
vote
2answers
182 views
Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
I am trying to find the protocol with the least overhead, which still meets the following requirements:
Server Authentication of server identity to client. The client has an authentic copy of the ...
0
votes
1answer
112 views
Diffie-Hellman is Post-quantum secured?
If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
0
votes
1answer
80 views
Can one detect if two pairs of elements in Zp have the same exponential relation?
Suppose that $p$ is a safe prime of 2048 bits ($p = 2q + 1$, and $q$ is prime).
Suppose that one is given two pairs $(x_1, y_1)$ and $(x_2, y_2)$ such that:
$y_1 = x_1^{r_1} \pmod p$
$y_2 = ...
0
votes
1answer
122 views
Digital signatures in SSL/TLS-like protocols
The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
0
votes
1answer
99 views
Zero Knowledge auth schemes with weak secret
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no ...
0
votes
1answer
272 views
How do I generate a session key using the Diffie Hellman algorithm?
How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
0
votes
1answer
144 views
Ways to protect flash player against MITM diffie hellman
We have a server, which sends content encrypted with AES128 or RC4 to a flash client over an insecure HTTP channel. The encryption key is negotiated using Diffie Hellman.
The problem:
Diffie ...
0
votes
1answer
393 views
BouncyCastle Elliptic Curve implementation
I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).
...
0
votes
1answer
155 views
How can the Diffie-Hellman key exchange be extended to three parties? [duplicate]
Possible Duplicate:
Can one generalize the Diffie-Hellman key exchange to three or more parties?
How can Alice, Bob, and Charlie share a common secret key using an extended version of the ...
