# Tag Info

1

Through repeated DH attempts, could Alice and Bob build a large random key for use as a one-time pad? No, since that is not how a one time pad works. You can use your idea to create cryptographic material to encrypt plaintext using XOR, what you are describing is an asymmetric stream cipher of some sorts. A one time pad requires an "offline" exchange ...

1

Guess the catch in the video is in how the participants exchange details 'publicly'. If the Man-In-The-Middle can intercept and manipulate what is being 'publicly' shared, then the attempt to eavesdrop would still be successful.

5

$\mathbb{Z}^*_{13}$ is a group with 12 elements, not 13. A group is defined by a set of elements, and a "law". The law combines two elements and yields a third one within the set. You get a group if the law fulfils some properties (the law is associative, there is a neutral element, each element has an opposite in the group). $\mathbb{Z}_{13}$ is a group ...

3

A lot of modern cryptography is based on some mathematical assumptions and aims to achieve what is called Computational Security. That means that the adversary (Eve) could get some information about the plaintext with a negligible probability and the adversary is modeled as someone with bounded computational power, storage and bounded time. So all the ...

0

Adding another answer to my own question with a link to a new paper: "Batch NFS", by Daniel Bernstein and Tanja Lange (http://cr.yp.to/papers.html#batchnfs). This paper shows, assuming standard heuristics regarding the number-field sieve, that a “batch NFS” circuit of area $L^{1.181\dots+o(1)}$ factors $L^{0.5}+o(1)$ separate $B$-bit RSA keys in time ...

0

It's an element of the field of all integers modulo $p$, and these are represented by the numbers $0,\ldots, p-1$. And $g$ will be one of them.

1

Ensuring that you're talking to the correct server is the client's duty. They need to verify the certificate and reject anonymous DH. A client that accepts anon DH or doesn't verify the server's certificate is always vulnerable to MitM, even if the server disables anon DH. Thus disabling anonymous DH on the server has little effect on security, beyond ...

1

If there are absolutely no clients that implement DH_anon (or ECDH_anon), then an attacker cannot exploit those cipher suites. When setting up your server, how do you know that there are none? How do you know someone won't plant a backdoor in a client somewhere to force those cipher suites? Better to be safe than sorry and risk your users' private data.

2

The twist attack is best explained in Fouque et al's paper. While the (quadratic) twist of the curve $E : y^2 = x^3 + ax + b \in \mathbb{F}_p$ is indeed of the form $E^t : y^2 = x^3 + d^2ax + d^3b \in \mathbb{F}_{p}$ for nonsquare $d$, you can also think of the twist as the set of points $(x, y)$ in $E^2 : y^2 = x^3 + ax + b \in \mathbb{F}_{p^2}$ where $x$ ...

Top 50 recent answers are included