Bob and Alice, both generate a temporary public key pair each using X algorithm on their individual PC.
After being authenticated by a third party, they use the DHE to come to get a common symmetric key; This key is used for the encryption of messages sent between them for that session. After the session is over, all the mentioned keys are forgotten.

My question primarily is what would be an appropriate algorithm 'X'
Also, if there is a vulnerability in the above presented scenario, kindly mention it.

  • $\begingroup$ I would use DH key generation. What's your actual question? $\endgroup$ – Maarten Bodewes Dec 13 '15 at 19:12
  • $\begingroup$ As far as i understood, DH algorithm is essentially a key Exchange algorithm, not a key Generation algorithm; and RSA / ECDHE etc are the algorithms used to do so. from your comment, i suppose that is incorrect $\endgroup$ – Josh Kurien Dec 13 '15 at 19:18
  • $\begingroup$ My question was basically asking what algorithm would be relatively secure, can be used to generate keys without intensive computing and can be used in the DH Exchange! $\endgroup$ – Josh Kurien Dec 13 '15 at 19:20
  • 1
    $\begingroup$ Nah, you'd still have to generate the keys to perform the key exchange itself. You can pre-compute / reuse them, but mind that the keys should be large enough or you'd run into things like the Logjam attack. $\endgroup$ – Maarten Bodewes Dec 13 '15 at 19:24
  • $\begingroup$ Exactly, I was talking about generating the keys, before the key exchange, which algorithm would be ideal to compute those keys on the fly! $\endgroup$ – Josh Kurien Dec 13 '15 at 19:26

Using ECDHE as an example, the steps are like this,

  1. The client sends supported named curved list.
  2. The server chooses a curve and generate key-pair, and sent back curve type and public key.
  3. The client uses the server curve type to generate key-pair, and send back curve type and public key.

Now, both client and server can generate same secret(i.e. pre-master secret in SSL)

| improve this answer | |
  • $\begingroup$ I don't think this really answers the question, which seems to be about how your step 2. works. $\endgroup$ – otus Jan 10 '16 at 12:57
  • $\begingroup$ ECC is used to generate key-pair. Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. $\endgroup$ – Song Jan 11 '16 at 0:22
  • $\begingroup$ Also, client and server don't generate key-pair upfront. They will negotiate the domain parameter first. $\endgroup$ – Song Jan 11 '16 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.