Reputation
455
Next privilege 500 Rep.
Cast close & reopen votes
Badges
2 4
Newest
 Yearling
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 7 votes cast
Jul
24
comment Favor hash size or field size when systems are disparate?
Note that both MQV and HMQV are patented.
Jul
20
comment Favor hash size or field size when systems are disparate?
I disagree with the standardization/difference between theoretical and practical crypto. MQV was standardized in IEEE P1363, and there has been an attempt made to also have HMQV included. I can't seem to quickly find what came out, but it does imply the information you are looking for is out there. IEEE P1363 reference: en.wikipedia.org/wiki/IEEE_P1363 Proposal to add HMQV: grouper.ieee.org/groups/1363/P1363-Reaffirm/submissions/…
Jul
15
comment Is this hypothetical key-exchange secure?
In the message flow, you use small k in the first message, where I would think it might mean a pre-shared key. In the third message, you encrypt k, which suggests it is something else.
Jul
15
comment Is this hypothetical key-exchange secure?
What is small k? Is it a pre-shared key between A and B?
Sep
16
comment Automated security protocol verification tool for eCK model
Most security models for key exchange protocols, including eCK, are descendants of [Bellare Rogaway 1993][1]. The differences among these variants are subtle and AFAIK there is no agreement on which one you should use. This is still a topic of active research so don't expect a definite answer here. [1]: cseweb.ucsd.edu/~mihir/papers/eakd.pdf
Jul
8
comment Authenticated DH, what protocols are secure?
There has been a lot of debate about the exact relation/improvements of HMQV over MQV, but IMO these discussions do not have significant practical impact. Especially since most standards require that the group element checks are included. This however reduces some of its claimed efficiency gains. These debates mostly concern the provable security claims and/or the precision of the security models.
Jun
30
comment Formal definition of (perfect) forward security/secrecy
If the protocol stores the session key for law enforcement (or, say, encrypts it with the public key of law enforcement agencies and includes this in a transmission) then of course perfect forward secrecy is not satisfied wrt those agencies.
Jun
28
comment Formal definition of (perfect) forward security/secrecy
Possibly they mean shielding the communications from adversaries on the network; but of course on their servers your communication is in plaintext. Legislations for storing data/wiretapping are a very different threat model. I would guess that their statement simply means that they're using SSL/TLS in a Diffie-Hellman mode.
Jun
28
comment Formal definition of (perfect) forward security/secrecy
I agree, and I doubt that the formal definitions you will find will have any relation to the claims made by such companies.