Key exchange protocols allow two parties to produce a secret session key over a public channel.

learn more… | top users | synonyms

1
vote
1answer
74 views

Non-numeric Diffie-Hellman?

It may seem that this is a programming question, but I just need advice on the cryptography side of the question. I want to implement the Diffie-Hellman key exchange algorithm on iOS (since no free ...
1
vote
0answers
71 views

Diffie-Hellman, RSA and the types of public key cryptography

Are these schemes fundamentally different? Are other schemes fundamentally different in the sense that you can do different operations with them (or the same operations, but needing different ...
4
votes
1answer
141 views

Private and Public Keys

I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ...
7
votes
4answers
765 views

Exchanging encrypted messages, and decrypting without a public key?

I know very little about encryption, but I was hoping someone could shed light on this cipher text exchange scheme I worked out in my head this morning: Bob wants to send Alice a message but doesn't ...
0
votes
0answers
19 views

HMQV and MQV group representation attack

Currently reading Krawczyk's HMQV paper https://eprint.iacr.org/2005/176 and trying to follow what he says about the group respetnation attack on MQV: It says that for any group of prime order $q$, ...
2
votes
1answer
2k views

Does IKEv2 protocol have two modes like IKE

IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
2
votes
2answers
296 views

Can you help me understand PFS and wPFS?

Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them. My understanding is that: PFS ensures that, if the ...
1
vote
0answers
55 views

key exchange using hashing with preshared secret

I came upon an idea the other day that I had some questions about. I am not a security professional but I do study with an amateur interest and have not heard of this particular idea before. There ...
3
votes
1answer
65 views

How is a group element converted into a key?

I've only just started research on cryptography so I apologize if this is a basic question or I'm getting terms confused. I'm researching braid group cryptography and currently looking at the Anshel-...
1
vote
1answer
86 views

How can one protect against a Man In The Middle attack during key exchange without using certificates?

Besides using a certificate to defend against a man in the middle attack during a key exchange, what methods can be used?
7
votes
3answers
908 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
1
vote
0answers
39 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $prv$. It accepts as input any point $Q$ lying in the proper subgroup of the proper ellipict curve, then computes: $P = prv*Q$...
3
votes
2answers
59 views

How does the size of the prime affect Elliptic Curve Bit Security?

I am using the MIRACL Library to implement an Elliptic Curve Diffie Hellman based Key Exchange according to ECDH-Scheme-Wikipedia. Referring to the Miracl Docs they suggest a few curves. Each curve ...
8
votes
1answer
848 views

What Diffie-Hellman parameters should I use?

After reading this article, I started wondering how should I approach the problem of choosing p and g params in 1024-bit Diffie-Hellman key exchange. In my project, I am going to establish keys ...
2
votes
1answer
55 views

Design for file transfers to a new party

I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet. Here's my current thought for Alice wanting to send Bob ...
2
votes
1answer
273 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
1
vote
1answer
65 views

Byte size of Diffie-Hellman public values

I have a scenario that uses RFC-3526's Diffie-Hellman Group 14 for 2048 bit key exchanges. From the document, it specifies the P (prime) value in hexadecimal value as: ...
1
vote
1answer
207 views

Is this variant of SRP for peer-to-peer authentication practical?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
2
votes
2answers
82 views

Why is (gy, gx) signed in STS (station-to-station)?

My question relates to the station-to-station protocol as described in https://en.wikipedia.org/wiki/Station-to-Station_protocol [1] and http://cacr.uwaterloo.ca/hac/ [2] p 519. ...
1
vote
2answers
694 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
1
vote
1answer
43 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
1
vote
3answers
231 views

How is a public/private key pair generated from a Diffe-Hellman key exchange?

I very well understand the DH key exchange. But what is the public key and private key at the end of the exchange. For example: Alice and Bob agree to use a modulus $p = 23$ and base $g = 5$ (which ...
2
votes
1answer
346 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
1
vote
1answer
38 views

Do random oracles are called even by honest users in the PAK protocol [BMK00]?

In the full-length proof of PAK scheme, the authors made extensive use of random oracles to extract (guessed) password from the messages generated by the real world adversary for the ideal world ...
3
votes
3answers
101 views

Authenticate ephemeral key exchange

At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange. If both ...
18
votes
5answers
3k views

What is the post-quantum cryptography alternative to Diffie-Hellman?

Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
4
votes
1answer
143 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
2
votes
0answers
61 views

Most Secure Exchange of Keys [closed]

Given both Alice and Bob must exchange IP addresses to perform such an operation, what is the most secure way Alice and Bob can exchange public keys between two mobile devices without having to rely ...
1
vote
1answer
165 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
2
votes
1answer
37 views

Exchanging keys via third party

In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages ...
4
votes
1answer
157 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
2
votes
1answer
119 views

variant of Diffie–Hellman key exchange protocol

Motivation Consider the following variant of Diffie-Hellman key exchange protocol for two parties: Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$ Alice samples $a$ ...
1
vote
1answer
67 views

Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session ...
0
votes
1answer
52 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
1
vote
2answers
112 views

Does this chat protocol exist?

I want to implement a secure chat via mobile. I´ld like to know if the following protocol for key agreement – which can use any asymmetric encryption – exists. Suppose Alice and Bob are two clients ...
1
vote
1answer
200 views

Is this hypothetical key-exchange secure?

I've thought about the following (generic) key-agreement protocol. The only weaknesses I could have found are missing freshness guaranteees. As for the notions: $E^1_K(P)$ is the symmetric encryption ...
1
vote
2answers
2k views

ECDH VS. DH benchmarking in JAVA

So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key. I compare the time it takes to generate: ...
3
votes
1answer
203 views

Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
10
votes
1answer
2k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
4
votes
1answer
410 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
2
votes
1answer
82 views

J-PAKE : About Schnorr NIZK proof for ephemeral private keys

Reading J-PAKE Authenticated Key Exchange Without PKI document : J-PAKE Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g : To prove the knowledge of the exponent for X = g^x1 ...
1
vote
1answer
73 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
4
votes
1answer
641 views

Implementations of Ntru TLS

Has anyone come across any implementations of Ntru TLS? I'm working a project for uni that does quantum secure encryption. It relies on a mix of Ntru & AES, but I can't find an implementation of ...
2
votes
1answer
220 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
3
votes
3answers
270 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
1
vote
1answer
117 views

SSH rekey security implications

When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing ...
4
votes
1answer
728 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
16
votes
2answers
1k views

GPG/PGP Verification of Revocation

How does one verify a key revocation? After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such: ...
1
vote
1answer
106 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
0
votes
2answers
126 views

Sending the next one-time pad key in this one-time pad message? [duplicate]

I am doing a research project on cryptography next year, and I'm really new to cryptography. This isn't some really advanced thing or anything, and I'm just trying to come up with something basic. ...