Tag Info

1

Also, the algorithm given in the mentioned paper has a complexity os $\tilde{O}(p^{\frac{1}{4}})$. The best known attack (As mentioned by de Feo, Jao and Plut) on the SSIKE is based on the claw finding problem (see below) and has a complexity of $\theta(p^{\frac{1}{6}})$. Very interesting paper btw ;): Claw finding algorithm using quantum walk

2

Sorry I will have to answer my own question. I received a mail from Luca De Feo a moment ago. "Nope, I discussed this at length with Jean-François Biasse, and we couldn't find a way to apply this kind of attack to SSIKE." I'll leave this question around for reference for the next person who wonders.

0

I would also mention that there are many required properties that you want a authenticated key exchange (AKE) protocol to satisfy, e.g. authentication, key confirmation, forward secrecy, key freshness, secrecy on the session key. What you want is allow Alice and Bob to stablish "session keys" for each session of communication. These session keys are ...

3

Basically yes, you can do that. Public keys are meant to be shared. The devil is in the details however: public keys without trust are pretty useless as you don't know who you are performing the key agreement with; two static keys will always generate the same key for the same partners if you use a naive DH implementation, something you probably don't ...

3

I have never heard of this reason, and I don't quite understand it. In general, the security of Diffie-Hellman key exchange is reduced to the DDH assumption. According to this assumption, the result of the key exchange is a group element that is computationally indistinguishable from a random/uniformly distributed element in the group. However, what is ...

0

To show that the protocol is secure under DDH, we need a reduction $R$ that takes a triple as input and outputs a transcript and key such that if the triple is a DDH triple, then the transcript and key are distributed identically to a real execution of the protocol if the triple is random, then the transcript and key are distributed as if you ran a real ...

2

This is plain DH, not ECDH. There's no Elliptic Curve here. For plain DH, the modulus should be a safe prime $p$ and the generator should generate the $q=(p-1)/2$ order subgroup. Unlike RSA, these numbers are public and can be shared between all users - one can use standardised ones for example the RFC 5114 ones for SSL/TLS (which are actually NIST ...

1

I have sent this question to the ProVerif mailing list as suggested in the comments. The response I obtained from Bruno Blanchet was as follows. Actually, ProVerif does not say that the code is dead, it just says that it cannot prove that it is not dead. (It says "RESULT not attacker:serverFinished_96[...] cannot be proved.") If it said "RESULT not ...

6

SHA-1 is still thought to be secure whenever collision resistance isn't required. The hash is both used for signing certificates and ECDHE public keys. There's however a difference with regard to collision attacks. It is possible for an attacker to attack the collision resistance with certificates by getting their own certificate signed by a CA. In ECDHE ...

1

[Isn't this] just as hard as the RSA problem? Oddly enough, no. If we were given a random $p$, and were asked to see if there's a large prime factor $q$ of $p-1$, yes, that would be, on average, a hard problem. However, that's not what we actually do. Instead, we get to pick $p$, and so that gives us a lot of flexibility. One way is to pick $q$ ...

Top 50 recent answers are included