# Tag Info

1

Diffie-Hellman comes in two basic forms - static and ephemeral - and a number of combinations of those. Ephemeral Diffie-Hellman means that both parties of a key agreement generate new - ephemeral - key pairs and send their respective ephemeral public key to the other party. If both parties generate ephemeral key pairs each time, you get Perfect Forward ...

0

I would like to know what can possibly go wrong when generating custom groups for use as Diffie-Hellman parameters. Aside from the mathematical issues that others have described, if you generate a parameter yourself, you need to convince the other party that you're exchanging keys with that the parameter that you have given them is actually a prime ...

3

One requirement that you don't have listed is that the generator $g$ needs to generate a subgroup that's of a large prime order; here's what can go wrong if that is not true: If the order of $g$ (which we call $q$) has a factor $r$, then the attacker can, hearing $g^x$, determine $x \bmod r$ in $O(\sqrt{r})$ time. If $r$ isn't large, this immediately ...

1

One consideration might be to generate a group so that the prime modulo p can be written in the form: $$p = 2q +1$$ Where $q$ is prime. Since every subgroup of $Z_p$ has order $a$ such that $a|p-1$ the only possible subgroups of this group have order either 2 or $q$. Then you can use a generator for the subgroup of order $q$.

2

Indeed, in both cases an attacker has to factor the group order and compute logarithms in small subgroups, but in the non-prime case there is an additional step: factoring the modulus. The standard algorithm for computing logarithms in smooth-order groups requires a factorization of the group order. Of course, If those factors are "small", anyone can ...

3

[In the non-prime case] For the backdoor to work, the discrete log should be do-able in $p_i^{k_i-1}(p_i - 1)$ Actually, that's not quite correct, and that's relevant for the answer. If the factorization of $p_i^{k_i-1}(p_i - 1)$ is $p_i^{k_i-1} q_1^a q_2^b ... q_n^z$, then for NOBUS to work, someone else shouldn't be able to find the factors $q_i$. ...

2

You need an authentic channel from Alice to Bob to get a secret channel from Bob to Alice. This assumption is missing in a), so anyone in control of the communication channel can play man in the middle on any protocol. As long you don't have a secret channel from Alice to Bob or an authentic channel from Bob to Alice, Alice will never (= for any protocol) ...

13

How could this allow for a backdoor? Well, if you do DH modulo a composite, an attacker can recover the shared secret if they can solve the DH problem (or the DLog problem) modulo each of the primes that make up the composite. There are a couple of ways that could be used by someone who knows the factorization to solve the DLog problem easier than ...

5

Ephemerality does not refer to "a new session key being made each time a new session is set up", it refers to both parties' key pairs (and group elements) being freshly chosen. ​These Diffie-Hellman key pairs are should be ephemeral for forward secrecy; the session key is always ephemeral, even if static-static Diffie-Hellman is applied. Any nonces are used ...

1

You can use ephemeral Diffie-Hellman and then use RSA to authenticate the parameters and established key seed the same way as TLS does. Java Card implementations usually contain an implementation of ECDH key agreement. An advantage is that you don't need very large key sizes to be reasonably secure. Furhtermore, ECDH operation and key pair generation is ...

1

Both RSA and DH have a similarity which is the Modulus Exponential (modexp) function (RSA encrypt/decrypt function). Since both RSA and DH uses the same modexp function, you can make full use of the Cipher for ALG_RSA_NOPAD in JavaCard's crypto API. I have sat down and taken time to adapt the RSA crypto functions for traditional non-ECC type of DH functions ...

1

Diffie-Hellman relies on a mathematical problem on positive integers. To use it with bytes you just have to convert the bytes to - or use the bytes as - an integer. Usually this would be a unsigned big-endian (or network order) integer. For Diffie-Hellman the parameters consist of the modulus and the base. The public value could be 1024 bits (128 bytes). ...

2

I will assume for simplicity that you're talking about the full multiplicative group of $F_p$ instead of a proper subgroup, thus there are no problems with $g^a+1$ (except when $g^a=p-1$ which can be trivially ruled out by comparing to $p$). The quantity $\log_g(g^a+1)$ is sometimes referred to as the Zech logarithm (strictly speaking, it is defined for ...

1

There is 3 kind of discrete log problem as you explained : Diffie-Hellman problem (Dlog): Pick $a \in \{1,\ldots,q\}$. Compute $A = g^a (mod\ p)$ Given $(p,q,g,A)$ find $a$. Assumed hard. Computational Diffie-Hellman problem (CDH) : Pick $a,b \in \{1,\ldots,q\}$. Compute $A = g^a (mod\ p)$ and $B = g^b (mod\ p)$ Given $(p,q,g,A,B)$ find $g^{ab}$. Note ...

14

These are completely different things: Man-in-the-middle is an active attack to a cryptographic protocol, where the attacker is, effectively, in between the communications of two users, and is capable of intercepting, relying, and (possibly) altering messages. In this case, the meaning of "in the middle" is direct: the attacker is in the middle of two ...

Top 50 recent answers are included