Key exchange protocols allow two parties to produce a secret session key over a public channel.

learn more… | top users | synonyms

8
votes
1answer
702 views

What Diffie-Hellman parameters should I use?

After reading this article, I started wondering how should I approach the problem of choosing p and g params in 1024-bit Diffie-Hellman key exchange. In my project, I am going to establish keys ...
2
votes
1answer
55 views

Design for file transfers to a new party

I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet. Here's my current thought for Alice wanting to send Bob ...
2
votes
1answer
206 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
1
vote
1answer
59 views

Byte size of Diffie-Hellman public values

I have a scenario that uses RFC-3526's Diffie-Hellman Group 14 for 2048 bit key exchanges. From the document, it specifies the P (prime) value in hexadecimal value as: ...
1
vote
1answer
202 views

Is this variant of SRP for peer-to-peer authentication practical?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
2
votes
2answers
72 views

Why is (gy, gx) signed in STS (station-to-station)?

My question relates to the station-to-station protocol as described in https://en.wikipedia.org/wiki/Station-to-Station_protocol [1] and http://cacr.uwaterloo.ca/hac/ [2] p 519. ...
1
vote
2answers
656 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
1
vote
1answer
43 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
1
vote
3answers
187 views

How is a public/private key pair generated from a Diffe-Hellman key exchange?

I very well understand the DH key exchange. But what is the public key and private key at the end of the exchange. For example: Alice and Bob agree to use a modulus $p = 23$ and base $g = 5$ (which ...
2
votes
1answer
272 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
1
vote
1answer
37 views

Do random oracles are called even by honest users in the PAK protocol [BMK00]?

In the full-length proof of PAK scheme, the authors made extensive use of random oracles to extract (guessed) password from the messages generated by the real world adversary for the ideal world ...
2
votes
3answers
89 views

Authenticate ephemeral key exchange

At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange. If both ...
17
votes
5answers
3k views

What is the post-quantum cryptography alternative to Diffie-Hellman?

Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
4
votes
1answer
125 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
2
votes
0answers
60 views

Most Secure Exchange of Keys [closed]

Given both Alice and Bob must exchange IP addresses to perform such an operation, what is the most secure way Alice and Bob can exchange public keys between two mobile devices without having to rely ...
1
vote
1answer
157 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
2
votes
1answer
35 views

Exchanging keys via third party

In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages ...
4
votes
1answer
137 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
1
vote
1answer
109 views

variant of Diffie–Hellman key exchange protocol

Motivation Consider the following variant of Diffie-Hellman key exchange protocol for two parties: Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$ Alice samples $a$ ...
1
vote
1answer
62 views

Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session ...
1
vote
0answers
229 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
0
votes
1answer
50 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
1
vote
2answers
110 views

Does this chat protocol exist?

I want to implement a secure chat via mobile. I´ld like to know if the following protocol for key agreement – which can use any asymmetric encryption – exists. Suppose Alice and Bob are two clients ...
0
votes
1answer
191 views

Is this hypothetical key-exchange secure?

I've thought about the following (generic) key-agreement protocol. The only weaknesses I could have found are missing freshness guaranteees. As for the notions: $E^1_K(P)$ is the symmetric encryption ...
1
vote
2answers
2k views

ECDH VS. DH benchmarking in JAVA

So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key. I compare the time it takes to generate: ...
3
votes
1answer
189 views

Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
10
votes
1answer
2k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
4
votes
1answer
398 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
1
vote
1answer
70 views

J-PAKE : About Schnorr NIZK proof for ephemeral private keys

Reading J-PAKE Authenticated Key Exchange Without PKI document : J-PAKE Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g : To prove the knowledge of the exponent for X = g^x1 ...
1
vote
1answer
62 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
4
votes
1answer
619 views

Implementations of Ntru TLS

Has anyone come across any implementations of Ntru TLS? I'm working a project for uni that does quantum secure encryption. It relies on a mix of Ntru & AES, but I can't find an implementation of ...
2
votes
1answer
220 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
3
votes
3answers
241 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
1
vote
1answer
96 views

SSH rekey security implications

When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing ...
4
votes
1answer
714 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
16
votes
2answers
1k views

GPG/PGP Verification of Revocation

How does one verify a key revocation? After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such: ...
1
vote
1answer
98 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
0
votes
2answers
110 views

Sending the next one-time pad key in this one-time pad message? [duplicate]

I am doing a research project on cryptography next year, and I'm really new to cryptography. This isn't some really advanced thing or anything, and I'm just trying to come up with something basic. ...
1
vote
1answer
298 views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
2
votes
1answer
447 views

VKO GOST R 34.10-2001 (described in RFC4357), Key Agreement Algorithm. Looking for its implementation/detailed description/examples

VKO GOST R 34.10-2001 was described in RFC4357 Page 7 But the description is very poor. Here it is: This algorithm creates a key encryption key (KEK) using 64 bit UKM, the sender's private key, ...
2
votes
2answers
91 views

Authenticated EC key exchange without a signing/signature scheme?

From my little understanding of EC-based authenticated key exchange protocols, I believe that it is not possible for authenticated key exchange without a signing/signature scheme. Is this correct? ...
0
votes
1answer
124 views

Rsa Key Exchange Protocol

Moderators: Maybe this question will be move to other sub-forum. My question is Anybody know some link with a tutorial of how implement the RSA key exchange protocol using java for chat comunication?
1
vote
3answers
137 views

Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
1
vote
1answer
79 views

Renewing session key

I have a system which (should) never shut down, there are keep alive messages every 30 seconds and normal traffic is very variable, might be a few KB/sec might be nothing more than the keep alive ...
1
vote
1answer
135 views

Beginner question about secure communication with one user using DES

I am currently learning about encryption and I was asked a question: If a customer only had a DES system how could I secure messages as DES is not secure. I was researching this and I came across a ...
0
votes
1answer
54 views

Different keys for clients but 1 key on server

Is it possible to have different keys on alot of (embedded) devices and just have 1 key on a server (to witch all these devices connect)? The main point here being when 1 device is compromised this ...
1
vote
2answers
229 views

correct usage of keys and nonce

I've being studying up on AES, GCM, CBC, HMAC and a lot of other primitives and am somewhat ( a little bit, perhaps) familiar with them however I am still a bit weary on the use of the keys and nonce. ...
1
vote
0answers
51 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
0
votes
1answer
70 views

Rationale of “r” AES key use in OTR version 3 AKE protocol?

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy I am a ...
1
vote
0answers
42 views

Using a Secure RNG in Probabilistic Fair Exchange

I am attempting to implement probabilistic fair exchange described in Probabilistic Non-Repudiation without Trusted Third Party. A secures a message using AES with 512 bit keys (in my ...