I don't know mucho about Cryptography, I try to understand, It's for homework.

Why the standard DH is not sufficient to ensure the security of the Diffie-Hellman key exchange?

My answer was:

In the standard Diffie-Hellman key exchange protocol, both parties compute the secret value gαβ for two privately chosen values $\alpha$ (by Alice) and $\beta$ (by Bob). An eavesdropper can publicly see the pair ($g^{\alpha},g^{\beta}$). So, if checking whether, for some $g^{\gamma}$, it is the case that $\gamma = \alpha \beta$, were computationally easy —i.e., the DDH assumption fails—, then the eavesdropper would have found $g^{\gamma} = g^{\alpha\beta}$ without disclosing $\alpha$ nor $\beta$ explicitly, even if the DH assumption is true. This is why the CDH/DDH are the assumptions that really matter in the key exchange.

  • 4
    $\begingroup$ Presumably you're talking about non-authenticated D-H? ("Schoolbook D-H"). Usually the first concern that comes to mind is the man-in-the-middle attack. $\endgroup$ – Dan Jun 15 '20 at 18:36
  • $\begingroup$ Are you referring to DH vs ECDH? $\endgroup$ – Woodstock Jun 15 '20 at 21:27
  • $\begingroup$ The teacher said it had nothing to do with authentication. $\endgroup$ – Romario Roca Jun 16 '20 at 12:23
  • $\begingroup$ Did you mean to say: why the DL assumption is not enough? Your example is going in the right direction and would need to be modified to say that even if the DL is hard, if it was possible to compute $g^{xy}$ from $g^x, g^y$ then the key exchange would not be secure $\endgroup$ – Marc Ilunga Jun 16 '20 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.