Skip to main content
Cryptography

Return to Question

Tweeted twitter.com/StackCrypto/status/1079301173637730304
typos
Source Link
kelalaka
kelalaka
  • 49.5k
  • 12
  • 118
  • 205

Why is diffieDiffie-hellman insecure if orderHellman Insecure If Order of the generator has only small prime factorsGenerator Has Only Small Prime Factors?

In this post from security SE, Tom Leek mentioned that, for diffieDiffie-hellmanHellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.

Why is it so? Order of $g$ has to be large, otherwise, the discrete log would be easy. But I couldn't see any other reason why the order of $g$ should have a large prime factor. And why should it be at least $2k$ bits long (instead of $k$ bits long)?

It also says the private keys $a$ and $b$ should also be $2k$$2\text{k}$ bits long. They should be large, otherwise, the discrete log would be easy. But why should they be $2k$$2\text{k}$ bits long, instead of $k$$\text{k}$ bits long?

Why is diffie-hellman insecure if order of the generator has only small prime factors?

In this post from security SE, Tom Leek mentioned that, for diffie-hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.

Why is it so? Order of $g$ has to be large, otherwise discrete log would be easy. But I couldn't see any other reason why the order of $g$ should have a large prime factor. And why should it be at least $2k$ bits long (instead of $k$ bits long)?

It also says the private keys $a$ and $b$ should also be $2k$ bits long. They should be large, otherwise discrete log would be easy. But why should they be $2k$ bits long, instead of $k$ bits long?

Why is Diffie-Hellman Insecure If Order of the Generator Has Only Small Prime Factors?

In this post from security SE, Tom Leek mentioned that, for Diffie-Hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter.

Why is it so? Order of $g$ has to be large, otherwise, the discrete log would be easy. But I couldn't see any other reason why the order of $g$ should have a large prime factor. And why should it be at least $2k$ bits long (instead of $k$ bits long)?

It also says the private keys $a$ and $b$ should also be $2\text{k}$ bits long. They should be large, otherwise, the discrete log would be easy. But why should they be $2\text{k}$ bits long, instead of $\text{k}$ bits long?

Improved formatting
Source Link
edit approved Dec 27, 2018 at 16:19
AleksanderCH
edit approved Dec 27, 2018 at 16:19
AleksanderCH
  • 6.5k
  • 10
  • 29
  • 63

In this postthis post from security SE, Tom Leek mentioned that, for diffie-hellman to be secure order of the group g$g$ should have a prime factor at least 2k$2k$ bits long, where k$k$ is the security parameter. 

Why is it so? Order of g$g$ has to be large, otherwise discrete log would be easy. But I couldn't see any other reason why the order of g$g$ should have a large prime factor. And why should it be at least 2k$2k$ bits long (instead of k$k$ bits long)?

It also says the private keys a$a$ and b$b$ should also be 2k$2k$ bits long. They should be large, otherwise discrete log would be easy. But why should they be 2k$2k$ bits long, instead of k$k$ bits long?

In this post, Tom Leek mentioned that, for diffie-hellman to be secure order of the group g should have a prime factor at least 2k bits long, where k is the security parameter. Why is it so? Order of g has to be large, otherwise discrete log would be easy. But I couldn't see any reason why order of g should have a large prime factor. And why should it be at least 2k bits long (instead of k bits long)?

It also says the private keys a and b should also be 2k bits long. They should be large, otherwise discrete log would be easy. But why should they be 2k bits long, instead of k bits long?

In this post from security SE, Tom Leek mentioned that, for diffie-hellman to be secure order of the group $g$ should have a prime factor at least $2k$ bits long, where $k$ is the security parameter. 

Why is it so? Order of $g$ has to be large, otherwise discrete log would be easy. But I couldn't see any other reason why the order of $g$ should have a large prime factor. And why should it be at least $2k$ bits long (instead of $k$ bits long)?

It also says the private keys $a$ and $b$ should also be $2k$ bits long. They should be large, otherwise discrete log would be easy. But why should they be $2k$ bits long, instead of $k$ bits long?

Source Link
satya
satya
  • 1.5k
  • 10
  • 32

Why is diffie-hellman insecure if order of the generator has only small prime factors?

In this post, Tom Leek mentioned that, for diffie-hellman to be secure order of the group g should have a prime factor at least 2k bits long, where k is the security parameter. Why is it so? Order of g has to be large, otherwise discrete log would be easy. But I couldn't see any reason why order of g should have a large prime factor. And why should it be at least 2k bits long (instead of k bits long)?

It also says the private keys a and b should also be 2k bits long. They should be large, otherwise discrete log would be easy. But why should they be 2k bits long, instead of k bits long?