# Tag Info

8

A safe prime is a prime number $p$ for which $(p-1)/2$ is also prime. The order of an element $g$ of the group $\mathbf{Z}^*_p$ (the integers modulo $p$, excluding 0) is the smallest integer $n$ such that $g^n\equiv 1\pmod{p}$; this is always a factor of $p-1$. The orders of the subgroups of the group generated by $g$ are the factors of the order of $g$; ...

6

Let's recall how discrete logarithms are solved in strong elliptic curve groups. The basic idea is to iteratively walk through many combinations of the form $x_i = a_iP + b_iQ$ until we find a distinguished one, i.e., one that shares some common property (like the lowest $k$ bits of $x_i$ set to 0). We accumulate enough distinguished points until we find a ...

3

Actually, RFC3526 does have recommendations for the random number size; see section 8, and the table listing "exponent size". Now, it gives two different recommendations (which sounds rather less useful than giving one); the summary is that if the size of the random number you pick is $x$ bits, then an attacker can recover the shared secret with no more ...

2

No. First, you've exposed a padding oracle by using unauthenticated AES. Secondly, you've not authenticated the devices: it's easy to mount a man in the middle attack. Thirdly, I don't understand the role of changing parameters all the time in your protocol.

2

Diffie-Hellman operates in a cyclic group by definition: the elements $g, g^a, g^b, g^{ab}$ are in the cyclic group generated by $g$. Technically, a monoid is sufficient, but since cryptography mostly operates in finite structures, you get a group anyway. In your example, you operate in the cyclic group $c\mathbf{Z}$, and as you were told in the comments, ...

1

TLSv1.1 doesn't have a different treatment of the key-exchange parameters than TLSv1.2 has. It's just a little less obvious. Let's dig into TLSv1.1 specification. On page 44 you'll find that ServerKeyExchange consists of ServerXXXParams params and Signature signed_params. Now on page 44 you'll actually find a definition of Signature. This definition signs ...

1

A client can indeed "regenerate" DH-keys. But this simply means he re-connects to the server. The Logjam attack works by recording the connection establishment and then compute the derived private key. For this attack to work the domain parameters of the DH-exchange need to remain unchanged as precomputation is neccessary. If you just reconnect the server ...

1

You can use the Lenstra and Verheul equations to calculate the size of the key x, e.g. by entering the prime size value at keylength.com: choose Enter basic parameter & select Enter a discrete log group size, enter the size in bits of your chosen prime and hit compute. Note that you may want to choose something nearby that is either $2^n$ or \$2^n + ...

Only top voted, non community-wiki answers of a minimum length are eligible