# Tag Info

6

SHA-1 is still thought to be secure whenever collision resistance isn't required. The hash is both used for signing certificates and ECDHE public keys. There's however a difference with regard to collision attacks. It is possible for an attacker to attack the collision resistance with certificates by getting their own certificate signed by a CA. In ECDHE ...

3

Basically yes, you can do that. Public keys are meant to be shared. The devil is in the details however: public keys without trust are pretty useless as you don't know who you are performing the key agreement with; two static keys will always generate the same key for the same partners if you use a naive DH implementation, something you probably don't ...

3

I have never heard of this reason, and I don't quite understand it. In general, the security of Diffie-Hellman key exchange is reduced to the DDH assumption. According to this assumption, the result of the key exchange is a group element that is computationally indistinguishable from a random/uniformly distributed element in the group. However, what is ...

2

This is plain DH, not ECDH. There's no Elliptic Curve here. For plain DH, the modulus should be a safe prime $p$ and the generator should generate the $q=(p-1)/2$ order subgroup. Unlike RSA, these numbers are public and can be shared between all users - one can use standardised ones for example the RFC 5114 ones for SSL/TLS (which are actually NIST ...

2

Indeed, theoretically $$X'\equiv C^{a^{-1}}\equiv A^{x*a^{-1}}\equiv g^{x}=X\pmod p$$ should hold, given $gcd(a,p-1)=1$. However there are two reasons why you won't get this equation to hold. You calculated $a^{-1}$ using the wrong modulus. As it is in the exponent you need to calculate $a^{-1}\bmod q$ with $q$ being the group's order instead of ...

2

Sorry I will have to answer my own question. I received a mail from Luca De Feo a moment ago. "Nope, I discussed this at length with Jean-François Biasse, and we couldn't find a way to apply this kind of attack to SSIKE." I'll leave this question around for reference for the next person who wonders.

1

What format must the x-coordinate bignum be converted to before hashing it? Any format works as long as it uniquely encodes the shared secret and is used by all parties. So if your code doesn't need to interact with other implementations, you can use whichever you like. If you need interoperability, you need to look at what others are using. E.g. SP ...

1

Also, the algorithm given in the mentioned paper has a complexity os $\tilde{O}(p^{\frac{1}{4}})$. The best known attack (As mentioned by de Feo, Jao and Plut) on the SSIKE is based on the claw finding problem (see below) and has a complexity of $\theta(p^{\frac{1}{6}})$. Very interesting paper btw ;): Claw finding algorithm using quantum walk

1

[Isn't this] just as hard as the RSA problem? Oddly enough, no. If we were given a random $p$, and were asked to see if there's a large prime factor $q$ of $p-1$, yes, that would be, on average, a hard problem. However, that's not what we actually do. Instead, we get to pick $p$, and so that gives us a lot of flexibility. One way is to pick $q$ ...

1

I have sent this question to the ProVerif mailing list as suggested in the comments. The response I obtained from Bruno Blanchet was as follows. Actually, ProVerif does not say that the code is dead, it just says that it cannot prove that it is not dead. (It says "RESULT not attacker:serverFinished_96[...] cannot be proved.") If it said "RESULT not ...

Only top voted, non community-wiki answers of a minimum length are eligible