Key exchange protocols allow two parties to produce a secret session key over a public channel.

learn more… | top users | synonyms

2
votes
1answer
300 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
1
vote
1answer
68 views

Byte size of Diffie-Hellman public values

I have a scenario that uses RFC-3526's Diffie-Hellman Group 14 for 2048 bit key exchanges. From the document, it specifies the P (prime) value in hexadecimal value as: ...
2
votes
2answers
85 views

Why is (gy, gx) signed in STS (station-to-station)?

My question relates to the station-to-station protocol as described in https://en.wikipedia.org/wiki/Station-to-Station_protocol [1] and http://cacr.uwaterloo.ca/hac/ [2] p 519. ...
1
vote
1answer
44 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
1
vote
3answers
252 views

How is a public/private key pair generated from a Diffe-Hellman key exchange?

I very well understand the DH key exchange. But what is the public key and private key at the end of the exchange. For example: Alice and Bob agree to use a modulus $p = 23$ and base $g = 5$ (which ...
2
votes
1answer
377 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
1
vote
1answer
39 views

Do random oracles are called even by honest users in the PAK protocol [BMK00]?

In the full-length proof of PAK scheme, the authors made extensive use of random oracles to extract (guessed) password from the messages generated by the real world adversary for the ideal world ...
3
votes
3answers
112 views

Authenticate ephemeral key exchange

At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange. If both ...
4
votes
1answer
147 views

ECDH and ECDSA in PGP with known public key

How are used ECDH and ECDSA in combination with public key ? Usually these methods are used for establish a secret themselves, ...
2
votes
0answers
62 views

Most Secure Exchange of Keys [closed]

Given both Alice and Bob must exchange IP addresses to perform such an operation, what is the most secure way Alice and Bob can exchange public keys between two mobile devices without having to rely ...
2
votes
1answer
37 views

Exchanging keys via third party

In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages ...
4
votes
1answer
162 views

Hashing a Diffie-Hellman result

In many implementations, the result of the Diffie-Hellman algorithm is hashed. I read that: Hashing the shared secret point prevents an attacker from gaining more information about the EC private ...
5
votes
1answer
424 views

Small subgroup confinement attack on Diffie-Hellman

I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ...
2
votes
1answer
127 views

variant of Diffie–Hellman key exchange protocol

Motivation Consider the following variant of Diffie-Hellman key exchange protocol for two parties: Assume Alice and Bob share $\mathbb{G}$ of order $q$ generated by $g$ Alice samples $a$ ...
1
vote
0answers
322 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
4
votes
1answer
134 views

UKS attack on KEA protocol

I'm trying to understand the UKS attack on KEA protocol. This is described in this paper: Security Analysis of KEA Authenticated Key Exchange Protocol So to summarize: KEA protocol: UKS ...
0
votes
1answer
53 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
1
vote
1answer
202 views

Is this hypothetical key-exchange secure?

I've thought about the following (generic) key-agreement protocol. The only weaknesses I could have found are missing freshness guaranteees. As for the notions: $E^1_K(P)$ is the symmetric encryption ...
2
votes
1answer
88 views

J-PAKE : About Schnorr NIZK proof for ephemeral private keys

Reading J-PAKE Authenticated Key Exchange Without PKI document : J-PAKE Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g : To prove the knowledge of the exponent for X = g^x1 ...
1
vote
1answer
77 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
3
votes
3answers
281 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
1
vote
1answer
129 views

SSH rekey security implications

When an SSH session is rekeyed due to either the time limit or data limit for rekeying having passed, does the Diffie-Hellman exchange take place within the encrypted channel provided by the existing ...
1
vote
1answer
119 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
3
votes
1answer
215 views

Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
0
votes
2answers
134 views

Sending the next one-time pad key in this one-time pad message? [duplicate]

I am doing a research project on cryptography next year, and I'm really new to cryptography. This isn't some really advanced thing or anything, and I'm just trying to come up with something basic. ...
1
vote
1answer
356 views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
1
vote
2answers
113 views

Does this chat protocol exist?

I want to implement a secure chat via mobile. I´ld like to know if the following protocol for key agreement – which can use any asymmetric encryption – exists. Suppose Alice and Bob are two clients ...
0
votes
1answer
134 views

Rsa Key Exchange Protocol

Moderators: Maybe this question will be move to other sub-forum. My question is Anybody know some link with a tutorial of how implement the RSA key exchange protocol using java for chat comunication?
1
vote
1answer
67 views

Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session ...
1
vote
3answers
140 views

Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
1
vote
1answer
95 views

Renewing session key

I have a system which (should) never shut down, there are keep alive messages every 30 seconds and normal traffic is very variable, might be a few KB/sec might be nothing more than the keep alive ...
1
vote
1answer
209 views

Is this variant of SRP for peer-to-peer authentication practical?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
2
votes
2answers
95 views

Authenticated EC key exchange without a signing/signature scheme?

From my little understanding of EC-based authenticated key exchange protocols, I believe that it is not possible for authenticated key exchange without a signing/signature scheme. Is this correct? ...
0
votes
1answer
57 views

Different keys for clients but 1 key on server

Is it possible to have different keys on alot of (embedded) devices and just have 1 key on a server (to witch all these devices connect)? The main point here being when 1 device is compromised this ...
1
vote
2answers
284 views

correct usage of keys and nonce

I've being studying up on AES, GCM, CBC, HMAC and a lot of other primitives and am somewhat ( a little bit, perhaps) familiar with them however I am still a bit weary on the use of the keys and nonce. ...
1
vote
0answers
54 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
1
vote
1answer
75 views

Rationale of “r” AES key use in OTR version 3 AKE protocol?

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy I am a ...
2
votes
0answers
44 views

Using a Secure RNG in Probabilistic Fair Exchange

I am attempting to implement probabilistic fair exchange described in Probabilistic Non-Repudiation without Trusted Third Party. A secures a message using AES with 512 bit keys (in my implementation)....
0
votes
1answer
92 views

New to cryptology, studying key exchange

I'm just getting an overview of some of the concepts in key exchanging at the moment, and I'm a bit disoriented on a few topics, namely key stretching, key derivation functions and perfect forward ...
1
vote
1answer
185 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
0
votes
0answers
153 views

Key exchange using hash function

Consider two types of attackers on a key exchange (KE) protocol and subsequent communication between the parties which used this KE instance to establish a secure communication key. Attacker Eve ...
1
vote
0answers
45 views

WPA and WPS: connection method [closed]

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
1
vote
1answer
78 views

Attack on key exchange with authentication

Suppose the honest parties - Alice and Bob - exchange public key in person/via telephone so that attacker can only eavesdrop on the line. Alice has hashed the public key using a collision resistance ...
1
vote
1answer
158 views

Beginner question about secure communication with one user using DES

I am currently learning about encryption and I was asked a question: If a customer only had a DES system how could I secure messages as DES is not secure. I was researching this and I came across a ...
2
votes
3answers
164 views

How does $g$ being a generator imply Diffie-Hellman's correctness?

In the Diffie-Hellman protocol for key exchange over an unsecured channel, we choose $p$ and $g$, where $g$ is a generator of $\mathbf{Z}_p^*$. However I want to know why this assumption makes the ...
0
votes
0answers
63 views

Key establishment protocols other than Diffie-Hellman

Are there any key agreement/exchange/establishment protocols which are NOT based around the Diffie-Hellman protocol or handshakes using public key cryptograaphy? DH seems to form the basis of this ...
1
vote
1answer
85 views

Can you exchange a shared key without any hardness assumptions?

Imagine that P=NP, and one way functions don't exist. Can two people end up with a random shared key of arbitrary length, if every exchange is public? They have true RNGs, and know who they are ...
2
votes
0answers
77 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
1
vote
1answer
111 views

Attacker in a key exchange

I'm having trouble with the following question: $X(A) \rightarrow B:(A,N_X)$ $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$ $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$ ...
1
vote
1answer
110 views

RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...