# Tag Info

5

Short key fingerprints are indeed vulnerable. But those are different from the short-authentication-string (SAS) used by ZRTP. A simple SAS based protocol using one-time keys could look like this: Alice sends a (collision resistant) hash of her public key to Bob. Bob sends his public key to Alice Alice sends her public key to Bob The short ...

3

I see you use the same generator on both sides (this need not work for any $n_1, n_2$ of course...). But even if this holds (trying a small example): Let 1 use $n_1 = 11, M=2$, and 2 uses $n_2 = 13, M= 2$. Check that $2$ is a generator for both of the multiplicative groups. If $d_1 = 7, d_2 = 9$, then $A = 2^7 \bmod 11 = 7$, while $B = 2^9 \bmod 13 = 5$. ...

1

The reason for both is that the generated values are trivial to detect / exploit and should be avoided and your RNG is deeply flawed if you actually get those values because the chance for this lies around $2^{-2000}$ if you use an appropriate parameter set. Now for the math: You need to choose your secret exponent $x$ such that $1\leq x\leq p-2$, with ...

1

This can be derived from two simple facts about the $mod$ operation: $a \bmod b = a + bi$ for some integer $i$ (for any $a, b$) $a \bmod c = b \bmod c$ if $a - b = ci$ for some integer $i$ With these two facts, we can look at $(g^a \bmod p)^b$; that can be simplified to $(g^a + pi)^b$ (for some integer $i$), and by the binomial expansion, this is \$g^{ab} ...

1

Elliptic curve security relies on the hardness of discrete logarithm on that curve. (Well, that's a simplification, but this will do for this answer.) When the curve contains N points, it takes an effort of roughly sqrt(N) "elementary operations" to break discrete logarithm. A prime p of "k bits" means that p is less than 2k, but greater than 2k-1. The ...

1

I assume the recommended approach is to use a KDF function like HKDF, but what is the security implication of taking an SHA-256 hash and using it directly for AES-256 or truncating it for AES-128 (Alice and Bob are using Java which doesn't have a native implementation of HKDF and I don't think it is a good idea to try and write your own). HKDF(-Expand) ...

Only top voted, non community-wiki answers of a minimum length are eligible