Hot answers tagged

3

[In the non-prime case] For the backdoor to work, the discrete log should be do-able in $p_i^{k_i-1}(p_i - 1)$ Actually, that's not quite correct, and that's relevant for the answer. If the factorization of $p_i^{k_i-1}(p_i - 1)$ is $p_i^{k_i-1} q_1^a q_2^b ... q_n^z$, then for NOBUS to work, someone else shouldn't be able to find the factors $q_i$. ...


2

You need an authentic channel from Alice to Bob to get a secret channel from Bob to Alice. This assumption is missing in a), so anyone in control of the communication channel can play man in the middle on any protocol. As long you don't have a secret channel from Alice to Bob or an authentic channel from Bob to Alice, Alice will never (= for any protocol) ...


2

One requirement that you don't have listed is that the generator $g$ needs to generate a subgroup that's of a large prime order; here's what can go wrong if that is not true: If the order of $g$ (which we call $q$) has a factor $r$, then the attacker can, hearing $g^x$, determine $x \bmod r$ in $O(\sqrt{r})$ time. If $r$ isn't large, this immediately ...


2

Indeed, in both cases an attacker has to factor the group order and compute logarithms in small subgroups, but in the non-prime case there is an additional step: factoring the modulus. The standard algorithm for computing logarithms in smooth-order groups requires a factorization of the group order. Of course, If those factors are "small", anyone can ...


1

Diffie-Hellman comes in two basic forms - static and ephemeral - and a number of combinations of those. Ephemeral Diffie-Hellman means that both parties of a key agreement generate new - ephemeral - key pairs and send their respective ephemeral public key to the other party. If both parties generate ephemeral key pairs each time, you get Perfect Forward ...


1

One consideration might be to generate a group so that the prime modulo p can be written in the form: $$p = 2q +1$$ Where $q$ is prime. Since every subgroup of $Z_p$ has order $a$ such that $a|p-1$ the only possible subgroups of this group have order either 2 or $q$. Then you can use a generator for the subgroup of order $q$.



Only top voted, non community-wiki answers of a minimum length are eligible