Tag Info

New answers tagged

1

It does not; the equation holds for any element $g$. The fact that $g$ is a generator means only that every element of the group can be obtained a key. This is not at all necessary for the protocol.


1

Since $g$, $A=g^a$ and $B=g^b$ are made public, everyone could repeat the same operation and brute force DH with small exponents. There are already many responses: link to security.stackexchange.com link to crypto.stackexchange.com Summary: considering a security level of $n$, it is advised to use exponents of at least $2n$ bits.


1

DLP and factorization are very different problems (which cryptocipher gurus consider of same complexity). You can't really compare the choice of using a safe prime p in order to prevent the factorization of n=p*q (recommended for RSA) with the choice of using a prime p where (p-1)/2 has a large factor (recommended for DSA). Since you are interested with DH ...


0

Eve shouldn't be able to find the shared secret easily from the messages Alice and Bob send. In the questions 1 and 2, you said that the shared secret is the sum/the product of the two messages, but anyone can compute them. Therefore, you are wrong. The shared secret should be: 1) $B=(128)(65)2 = (65)(128)2\mod p$, 2) ...


5

Update: My previous answer, although technically true, didn't answer your question. The issue is that the strong-DDH is not hard when using pairing groups, so my answer was merely stating that your problem is at least as hard as an easy problem (duh!) After some thought, I realized your problem is at least as hard as the 2-weak Bilinear Diffie-Hellman ...



Top 50 recent answers are included