2
$\begingroup$

I've found a post here: Small subgroup confinement attack on Diffie-Hellman which says we can pick $k$ in this way: enter image description here

And, as we know, $2$ will always be a prime-factor of $p−1$, therefore there will be a subgroup with two elements, that don’t generate anything besides themselves. Obviously the neutral element $1$ is in that subgroup, the other element is $p−1$; In this way, can we just pick $k = {(p-1) \over 2}$ as $w=2$; then, Eva can make sure that the so called shared key must be $1$ or $p-1$?

By the way, I really do some test and I find the result of shared key is really $1$....

But as far as I know, DH is really a secure algorithm, so I think I must have made a mistake; can anybody tell me where I'm mistaken?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Diffie Hellman is vulnerable to an active man in the middle (MITM) attack, and this is one version of such an attack, since Eve is modifying the transmitted values and forwarding them on.

See for example the question and answers here for MITM attacks on DH and possible countermeasures.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Thanks for your answer. It really remind me that maybe the countermeasure of this kind of attack is using the certificate; For let's say, if we consider Bob as a server end, it must have it's domain's certificate singed by any famous CA. Then, Alice will only establish the secure connection when Alice check the PUBLIC KEY B is the correct one described in Server's certificate which is singed by CA. $\endgroup$
    – Shi Tang
    Nov 24, 2022 at 2:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.