# Tag Info

6

I purposefully did not look at the details of the change you are proposing because whatever the change is, the answer is a resounding YES. If you make any change to a cryptographic construction, then you must prove the security of the modified scheme. If you are lucky, you may be able to reduce the security of the modified scheme to the original scheme, or ...

6

Use DLIES, which is essentially Diffie-Hellman with an ephemeral sender key. Assuming you know the receiver's public key, that will cost no extra round trips. The sender does: (eph_sender_private, eph_sender_public) = Generate_Key_Pair() shared_key = SHA-512(Diffie-Hellman(receiver_public, eph_sender_private)) ciphertext = Encrypt(shared_key, message) ...

3

However, in some protocols descriptions, like TLS 1.3, I find them say the client sends "hello message includes Diffie-Hellman public values for the client's preferred groups". What is "group" refers to?? The term group is a mathematical concept that guarantees that a specific operation doesn't leave a set, that it is associative, that there is a ...

3

are the DH public values exchanged unencrypted? Yes, that are. After all, they are "public values"; there's no weakness in exposing them in the clear. Now, we do have to be careful that they aren't modified in transit (if they can be, then someone can perform a Man-in-the-Middle attack). We do that by having the server sign its key share (using the ...

2

You are confusing two different security notions. The proof you describe is regarding the Onewayness under chosen-plaintext attacks (OW-CPA). Basically, this notion covers the idea that it shouldn't be possible for an adversary to decrypt a given ciphertext (i.e., encryption is one-way), even if he can encrypt chosen plaintexts. As the proof shows, ElGamal ...

1

No, it's no easier than the standard DBDH problem. Here's the reduction that shows that: suppose that we have an Oracle that solves your problem (given $g^s, g^y, g^r, g^t, g^{st-rs}, g^{(yr+d)/t}, e(g,g)^x$ is $e(g,g)^x = e(g,g)^{syr}$?) Now, suppose we're given $g^s, g^y, g^r, e(g,g)^x$, and are asked whether $e(g,g)^x = e(g,g)^{syr}$. What we do is ...

Only top voted, non community-wiki answers of a minimum length are eligible