# Tag Info

5

There are several possible ways to generate a weak DH group: The attacker can generate a $g$ with a small order; this would make deriving the shared secret from the public values easy. The attacker can generate a $g$ with a smooth order; that is, the order is large, but is composed of small prime factors; this would make deriving the shared secret from the ...

4

You can't encrypt a message with ECDH alone, because all it gives you is a shared secret that you can't really control. Rather, you use that secret in a symmetric scheme like AES (generally after passing it through a KBKDF to convert from an ECDH result to a proper-length and less-structured symmetric key, which you then use as the key for symmetric crypto). ...

2

It sounds like you are thinking of performing static-static Diffie-Hellman. If that is performed naively then it will indeed derive the same secret time and time again. At least one of the key pairs needs to be non-static or ephemeral, or an additional variable (nonce) should be introduced. For instance in NIST SP 800-56A there is section 6.2.1: "Initiator ...

2

SRP with the user's key = 0 is identical to DH. SRP with a publicly known key is identical to DH with a constant multiplier. For private key $x$, user ephemeral value $a$, server ephemeral value $b$, and $u$ derived from shared values, SRP ends up calculating the value $g^{ab + uxa}$ (which is then typically hashed to get the shared key). If $x$ is zero, ...

1

$p-1$ is certainly a weak private key, in that it forces the shared secret to be a constant value as: $a^{p-1} \bmod p = 1$ (This is known as Fermat's Little Theorem; no relation to Fermat's Last Theorem) Hence, if either side uses $p-1$ as there private key, then both sides would arrive at the value of 1, and that's not great for security.

1

The usage of the r key forces both parties to "fix" the public DH keys. So Alice doesn't know Bob's public DH key before she's generating her own one. And Bob can not make the choice of the public key dependant on Alice's choice and vice versa. This forces both parties to be honest and to generate both public keys at random as there is no opportunity to ...

Only top voted, non community-wiki answers of a minimum length are eligible