# Tag Info

5

The answer is yes; see Chapter 21 of Galbraith's book. Suppose we have your Fixed-Inverse-DH oracle $O(\cdot)$, and given $g^a$ and $g^b$ we want to find $g^{ab}$. We do this in two steps. First, we use $O$ to compute $g^{a^2}$ from $g^{a}$—this is a related problem called the Square-DH problem. Then we use the quarter-squares identity to compute $g^{ab}$. ...

2

Key exchange is notoriously hard to get right, and I strongly recommend not to do your own (unless your security requirements are really minimal). For example, what you propose does not provide forward security, which is generally considered of great importance in key exchange protocols. The good news is that there is a paper doing exactly what you need; ...

1

in diffie-hellman key exchange algorithm vulnerability's is good defined by RSA lab : "The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack. In this attack, an opponent Carol intercepts Alice's public value and sends her own public value to Bob. When Bob transmits his public value, Carol substitutes it with her own and sends it to ...

1

Curve25519 was supposed to be mainly used for Diffie-Hellman key-exchange and it provides ~128bit security and should fulfill all standard security assumptions on elliptic curves (and even some more). Now to answer the question is: yes. ElGamal can be used securely with Curve25519, as ElGamal is simply a Diffie-Hellman key-exchange ($\delta= m*g^{\alpha ... 1 If the order of$a=-1\mod{p}$and$b=a^{e}\mod{p}$, then$b=\pm{1}\mod{p}$. If$b=1\mod{p}$, the discrete logarithm is$0$. If$b=-1\mod{p}$, the discrete logarithm is$1\$.

1

The inventors of the Supersingular Isogeny Key Exchange, Defeo, Jao and Plut have posted some code on GITHUB at: https://github.com/defeo/ss-isogeny-software/ There is also a paper on implementation of this key exchange by some people from the University of Waterloo. Their paper is "Efficient Implementations of A Quantum-Resistant Key-Exchange Protocol on ...

Only top voted, non community-wiki answers of a minimum length are eligible