Tag Info

New answers tagged

1

TLSv1.1 doesn't have a different treatment of the key-exchange parameters than TLSv1.2 has. It's just a little less obvious. Let's dig into TLSv1.1 specification. On page 44 you'll find that ServerKeyExchange consists of ServerXXXParams params and Signature signed_params. Now on page 44 you'll actually find a definition of Signature. This definition signs ...


5

Let's recall how discrete logarithms are solved in strong elliptic curve groups. The basic idea is to iteratively walk through many combinations of the form $x_i = a_iP + b_iQ$ until we find a distinguished one, i.e., one that shares some common property (like the lowest $k$ bits of $x_i$ set to 0). We accumulate enough distinguished points until we find a ...


1

A client can indeed "regenerate" DH-keys. But this simply means he re-connects to the server. The Logjam attack works by recording the connection establishment and then compute the derived private key. For this attack to work the domain parameters of the DH-exchange need to remain unchanged as precomputation is neccessary. If you just reconnect the server ...


7

A safe prime is a prime number $p$ for which $(p-1)/2$ is also prime. The order of an element $g$ of the group $\mathbf{Z}^*_p$ (the integers modulo $p$, excluding 0) is the smallest integer $n$ such that $g^n\equiv 1\pmod{p}$; this is always a factor of $p-1$. The orders of the subgroups of the group generated by $g$ are the factors of the order of $g$; ...


0

The key exchange should also be authenticated. $\:$ GCM mode would mostly do that; however, you should authenticate an indication of which message is for Diffie-Hellman. (For example, you could use associated_data = 1 for the Diffie-Hellman messages and associated_data = 0 || application's_associated_data for application-level messages.)


1

You can use the Lenstra and Verheul equations to calculate the size of the key x, e.g. by entering the prime size value at keylength.com: choose Enter basic parameter & select Enter a discrete log group size, enter the size in bits of your chosen prime and hit compute. Note that you may want to choose something nearby that is either $2^n$ or $2^n + ...


3

Actually, RFC3526 does have recommendations for the random number size; see section 8, and the table listing "exponent size". Now, it gives two different recommendations (which sounds rather less useful than giving one); the summary is that if the size of the random number you pick is $x$ bits, then an attacker can recover the shared secret with no more ...


0

You really want to authenticate, what use is confidentiality if some random intruder can pretend to be either host or client, or can insert themselves in the middle of the conversation? No need to break the encryption, you'd just give away the keys. If you need to protect the data from being seen, you also need to protect from more active attacks. There ...


2

No. First, you've exposed a padding oracle by using unauthenticated AES. Secondly, you've not authenticated the devices: it's easy to mount a man in the middle attack. Thirdly, I don't understand the role of changing parameters all the time in your protocol.


0

$p$ must be a prime number to construct a cyclic group with $p-1$ valid private exponents. Using a composite number might impose security issues and possibly performance penalties. The size of $p$ dictates the security as it forms the size of the field. The larger the field, the more private exponents to try. The more effort you have to find the used one. A ...


0

There is a well known technique for exponentation, you might read this http://en.wikipedia.org/wiki/Modular_exponentiation#Right-to-left_binary_method . The same techniques and its variants are used for matrix exponentiation ... You only need 256 squaring and at most 256 multiplications.


0

Why is diffie-hellman defined on a cyclic group[0]? Doesn't it work for any commutative operation which the inverse is hard to find? No, you need associativity as well; once you have that, your idea would work fine, once we find a semigroup (that's what we call sets with an operator that is associative) with the appropriate properties. That's the ...


2

Diffie-Hellman operates in a cyclic group by definition: the elements $g, g^a, g^b, g^{ab}$ are in the cyclic group generated by $g$. Technically, a monoid is sufficient, but since cryptography mostly operates in finite structures, you get a group anyway. In your example, you operate in the cyclic group $c\mathbf{Z}$, and as you were told in the comments, ...


0

Without the initial exchange of nonces, an attacker could replay a recorded handshake. Although an attacker can't use this to replay actual packets, an attacker could possibly execute a denial of service attack if the process protected by spiped is not expecting a large number of connections. The attack (assuming a modified spiped protocol that MACs the ...


0

Without the nonces, one could violate explicit authentication by replaying the group_element || MAC_tag messages.


2

SRP with the user's key = 0 is identical to DH. SRP with a publicly known key is identical to DH with a constant multiplier. For private key $x$, user ephemeral value $a$, server ephemeral value $b$, and $u$ derived from shared values, SRP ends up calculating the value $g^{ab + uxa}$ (which is then typically hashed to get the shared key). If $x$ is zero, ...



Top 50 recent answers are included