Tag Info

New answers tagged


It does not; the equation holds for any element $g$. The fact that $g$ is a generator means only that every element of the group can be obtained a key. This is not at all necessary for the protocol.


Since $g$, $A=g^a$ and $B=g^b$ are made public, everyone could repeat the same operation and brute force DH with small exponents. There are already many responses: link to security.stackexchange.com link to crypto.stackexchange.com Summary: considering a security level of $n$, it is advised to use exponents of at least $2n$ bits.


DLP and factorization are very different problems (which cryptocipher gurus consider of same complexity). You can't really compare the choice of using a safe prime p in order to prevent the factorization of n=p*q (recommended for RSA) with the choice of using a prime p where (p-1)/2 has a large factor (recommended for DSA). Since you are interested with DH ...


Eve shouldn't be able to find the shared secret easily from the messages Alice and Bob send. In the questions 1 and 2, you said that the shared secret is the sum/the product of the two messages, but anyone can compute them. Therefore, you are wrong. The shared secret should be: 1) $B=(128)(65)2 = (65)(128)2\mod p$, 2) ...


Update: My previous answer, although technically true, didn't answer your question. The issue is that the strong-DDH is not hard when using pairing groups, so my answer was merely stating that your problem is at least as hard as an easy problem (duh!) After some thought, I realized your problem is at least as hard as the 2-weak Bilinear Diffie-Hellman ...

Top 50 recent answers are included