# Tag Info

5

This is a reduction showing that if you can compute $g^{a^2}$ given $g^a$, then you can solve the computational Diffie Hellman problem. Here is the reduction. Let $A$ be an adversary that given $g^a$ for a random $a$, outputs $g^{a^2}$ with probability $\epsilon$. We construct $A'$ who receives $u=g^a$ and $v=g^b$ and works as follows. $A'$ runs $A$ three ...

3

I haven't checked, is $p$ a safe prime and/or is 4 a generator over $p$? Server has random secret $S$, known $p$ and $g$ a generator. I'm substituting in $V$ for your $g$, with $g = 4$. $V = g^S \mod p$ $V$ is a verifier of the server, as in SRP. $V$ is your $g$, so known by the client. Anyone knowing $V$ can establish communications with the server. ...

1

What is the value of $p$? What is the value of $g$? If $g = 2$, when he receives $4^X$, he could compute the square root of it so that he has $2^X$ which is your $A$.

1

As long as your understanding the protocol correctly, the only way this can work is if the server is figuring out $X$ and using that to compute $A$. With $p$ being only 512 bits, it is possible to compute $X$, given $B$. But it would still take a fairly long time to do that, so I'm guessing that is not what the server is doing. So, I'm guessing your ...

3

The best option you have is TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA. This is likely to provide most security, as the AES keylength is maximal and ECDSA keys tend to provide more security than RSA keys, as a 128-bit security level is quite common with ECDSA (field size: 256 bit) whereas 112-bit is the standard with RSA (keylength: 2048 bit). However in practice ...

1

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...

2

ECDH is not for signing. Your sign method using ecdh does not look like any valid signature scheme I have ever seen, and is therefore likely wildly insecure. Note that the Q&A you link to is asking a very different question.

3

For a given prime $p$, there are many choices for the generator $g$, but $g$ cannot be completely arbitrary. As the name hints, $g$ is supposed to be a generator of the multiplicative group $(\mathbb{Z}/p\mathbb{Z})^*$ (or at least a large subgroup, more on this later), that is, it must have the property that the set of its powers modulo $p$ \$\{g^1 \bmod p, ...

2

in diffie-hellman key exchange algorithm vulnerability's is good defined by RSA lab : "The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack. In this attack, an opponent Carol intercepts Alice's public value and sends her own public value to Bob. When Bob transmits his public value, Carol substitutes it with her own and sends it to ...

0

Depending on resources available on nodes and whether you are going to implement anything yourself, racoon and ipsec could be a solution. It supports nodes with x.509 certificates issued by a local CA. Please note this question is not simple at all.

2

Key exchange is notoriously hard to get right, and I strongly recommend not to do your own (unless your security requirements are really minimal). For example, what you propose does not provide forward security, which is generally considered of great importance in key exchange protocols. The good news is that there is a paper doing exactly what you need; ...

Top 50 recent answers are included