New answers tagged

7

What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man in the middle or the attacker can simply act as one of the entities. You can use static DH key pairs, but in that case the DH public keys must be trusted and ...


2

What is the common secret that is established used for? That of course depends on the protocol definition. In general it is used to establish secret session keys between the two parties to communicate. Generally you need one or two keys for either party; a key for encryption and a key for message authentication. Nowadays authenticated modes of encryption ...


4

There are many protocols that require a common secret between the two communicating parties. An obvious example is the establishment of a confidential channel between them, with respect to eavesdroppers: once the DH key exchange takes place and a common secret exists, it can be used to derive a secret symmetric key (as Kodlu mentions in the answer) that ...


7

It can be used as a key for a symmetric key algorithm. It can be used to derive a key via a standard key derivation mechanism.


8

What does DH add? Perfect Forward Secrecy. That is, suppose you have a secure session with the server Bob, and then you close the session down. Then, someone steals the server (or serves a warrant to the owner). If you use RSA to transport the random session key, well, the server still has the RSA private key, and so they'll be able to decrypt your ...


3

it simply tells a user to "calculate $y^*$", a calculation which itself appears to require several unknown values Nope, it has $y^* = y / g^V$, where at this point, you know $y$, $g$ and $V$. The original discrete log problem was given as $y = g^x$, and so you were given $y$ and $g$ In addition, $V = x \bmod z$, where $z$ is a smooth factor of $n$ (the ...


6

Can exponent be random number just like it is now or it should be a prime too? There is no particular advantage to be gained in selecting only prime exponents. Is using dynamic modulus and generator better idea? Whether it makes sense to use dynamic modulii is currently under debate. There are known algorithms that make attacking multiple discrete ...


0

Two parties choose private secrets $x_1$ and $x_2$, which they then exponentiate; $2^{x_1}$ and $2^{x_2}$, and swap with each other. Each party is now able to compute a shared secret, $s = (2^{x_1})^{x_2} = (2^{x_2})^{x_1}$, which can be used to initialize a symmetric cipher for further communication. When these operations are carried out modulo some ...


2

Diffie Hellman(DH) is a key exchange method, it is not a encryption/decryption algorithm. You have to use the secret key generated from DH in a symmetric cipher algorithm which is the algorithm used to create ciphertext from plaintext in the first place. For example, lets say Alice and Bob make a DH key exchange to generate a secret key $K$, then Alice uses ...


0

Unlike the primes used in RSA the prime used in DH does not need to be a secret, so using a well-known prime is not a problem from that point of view. On the other hand much of the work in breaking dh is per-prime not per dh session. That doesn't change the cost of breaking the first session but it does change the average cost of breaking a session. It is ...


6

In traditional DH Key exchange, users A and B derive a common secret $g^{ab}$ from their respective key pairs $(pk_A=g^a, sk_A=a)$ and $(pk_B=g^b, sk_B=b)$. Aside from active attacks, the security of the scheme depends on the Computational Diffie-Hellman (CDH) assumption, since it is difficult to compute $g^{ab}$ from public keys $g^{a}$ and $g^{b}$. If you ...



Top 50 recent answers are included