1
$\begingroup$

I was wondering how to measure the security strength of a generated secret key for the below protocol:

"A 128 bit random number is generated by TRNG and the random number will be used as a private key for Diffie-Hellman key exchange protocol. Two entities generate the shared secret key and that will be used as a session key for symmetric encryption."

My questions are:

  1. Is there any standard way to measure how secure the generated key is?
  2. What are the properties that the generated key should have to be resistant to attacks? Is there any paper/Standard document available that has the list of such properties?

Thanks.

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ Note: if you just generate a random 128 bit number $x$ and use that as the Diffie-Hellman private value (so the public value would be $g^x \bmod p$), then the resulting security strength of the generated secret key would be at most 64 bits... $\endgroup$ – poncho Mar 17 at 12:18
  • $\begingroup$ I have additional question. If ECDH is used here, is the security strength still half of the key length or its security strength is better? $\endgroup$ – Sami Mar 17 at 16:21
  • $\begingroup$ Still the same (as the same generic attack applies) $\endgroup$ – poncho Mar 17 at 17:28
1
$\begingroup$

The NIST special publication 800-90B is probably your go to here. It is the approach used to meet the FIPS 140-3 requirements which are accepted by as good assurance by a large population.

Different approaches are taken for TRNGs that are believed to produce independent, identically distributed outputs and others. One of the key measurements is the minimum entropy ($H_\infty$ in the Shannon-Renyi sense) that tracks the most probable output of some fixed size output. If the only information available to the attacker is the minimum entropy of the key, their guessing work should be at least on the order of $2^{H_\infty}$.

ETA: as pointed out in the comments, because your question is specifically about Diffie-Hellman, there are subexhaustive attacks. In particular 128-bit keys can be recovered with 64-bits of group operations using Pollard rho/baby step-giant step/Pollard kangaroo.

Improve this answer
$\endgroup$
5
  • $\begingroup$ dont you mean $2^{H_\infty}$? $\endgroup$ – kodlu Mar 17 at 12:14
  • $\begingroup$ Oops yes. I regularly make sign errors on entropy. Now changed. $\endgroup$ – Daniel Shiu Mar 17 at 12:18
  • $\begingroup$ Not sure which large population you're referring to, but 90B (especially the non-IID stuff) is pretty rubbish and you'd be very hard pressed to find anyone using it. Manufacturers and academia typically roll their own validation methodologies. $\endgroup$ – Paul Uszak Mar 17 at 13:09
  • $\begingroup$ Plus see @poncho 's comment which negates $2^{H_\infty}$ as we're referring specifically to Diffie-Hellman. $\endgroup$ – Paul Uszak Mar 17 at 13:11
  • 2
    $\begingroup$ Many RNG suppliers claim FIPS 140 compliance which cites 90B; given that the question asks about standards, I don’t feel that it’s an unreasonable direction to point them in. Agree that DH keys have subexhaustive attacks, hence my terminology of guessing work. $\endgroup$ – Daniel Shiu Mar 17 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.