# Does Diffie Hellman guarantee secrecy?

I am studying my Cryptology exam and one question I got stuck below;

Recall the Diffie-Hellman key establishment protocol. Alice runs this protocol over the Internet to communicate with Bob. Assume that the agreed key after running the protocol is k = g^ab (mod p). Alice then computes SHA256(k) and uses this as the key to encrypt a message m using AES. The resulting ciphertext is then sent to Bob. a) Does this protocol guarantee the secrecy of m?

I know that perfect secrecy is if the ciphertext provides no information about the plain text. Can somebody explain the above question to me?

• What happens if there is a man-in-the-middle attack? – SEJPM Jun 10 '18 at 16:49
• @SEJPM between Alice and Bob there is a one person, who is eavesdropping and getting the information between them. – M.J.Watson Jun 10 '18 at 16:58
• So, can an active man-in-the-middle attacker break the secrecy of $m$ or are active attackers not generally allowed? Also is your question on the understanding of the question, ie figuring out what it wants from your or are you asking for the solution of this preparation question? – SEJPM Jun 10 '18 at 18:02

The problem with this question is that it doesn't establish if the keys are static or not. If the keys are both static and a static-static (2S) DH protocol is used, then yes, this could guarantee secrecy if the public keys can be trusted to be from the right party, thereby authenticating A to B and B to A. A little used option of TLS is to use Diffie-Hellman based certificates, for instance.

Otherwise you're missing the authentication step, and Mallory could perform a man-in-the-middle by establishing keys A-M and M-B by tricking A and B that they are creating a secure channel to each other. Note that this is an active attack. it only works for Mallory - who can perform active attacks, not for Eve who can only eavesdrop the communication. Therefore "no" is most likely the correct answer.

• YM 'launch'. Or probably better 'perform'; 'launch' allows and to an extent suggests he can only start the attack but not complete it. – dave_thompson_085 Jun 11 '18 at 5:52

The answer to the exam question as written is no. Probably instructors want you to explain your answer even if the question is phrased as a yes-or-no question. It's a bad practice question because it doesn't give specifics and it doesn't prompt you on what type of answer it wants. It should say something like "If it isn't secure then in what ways is this insecure? (List reasons.) And if it is secure then explain why." Below is a non-exhaustive list of questions one might ask in response to a real-life person asking that question.

• How have the parameters of the DH (Diffie-Hellman) exchange been chosen? Should we assume the chosen parameters are secure? Is a "Logjam" style attack possible with the chosen DH parameters? *
• Are the DH keys public keys validated by both Alice and Bob? Or are they ephemeral? If there is no authentication of the exchanged keys then a man in the middle attack is possible. *
• Were DH keys generated with enough entropy to be unpredictable? *
• Are algorithms implemented correctly? Do bugs allow key recovery or leak plaintext information?
• Are side channels exploitable? Timing, power analysis, acoustic, electromagnetic?
• What mode of operation is used with AES? *
• Is anyone shoulder surfing?
• Is data remanence a concern? Or operator error?

Some of these are information security related points and may or may not be in the scope of a cryptography class. I marked with a * what I thought are mostly likely lead to one of the expected answers.