Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
0 votes
1 answer
56 views

How SSL (similar version) works?

My book suggested the following protocol to replace SSL: A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
user avatar
  • 3
-1 votes
1 answer
36 views

The benefit of the shared key generated from ECDH key exchange protocol [duplicate]

What the benefit of the shared key that generated from ECDH key exchange protocol? Can I use it to encrypt the message or encrypt the public key of asymmetric encryption?
user avatar
0 votes
0 answers
23 views

The appropriate smoothness bound

My question roots from another question asked in the community since I do not have enough reputation points to comment on the answer, I was hoping I could ask it here. How was the individual asking ...
user avatar
0 votes
0 answers
46 views

How to reduce Diffie Hellman problem to ElGamal?

I'm trying to answer without success questions (ii - iv) Any hint will be appreciated :)
user avatar
0 votes
0 answers
19 views

Looking for multi-party key exchange/shared secret algorithm with specific requirements

I'm looking for the ability to create a SINGLE CONSTANT shared secret amongst two or more users (a group) AND if a new user is added to such a secured group the new user should also be able to learn ...
user avatar
  • 169
0 votes
2 answers
65 views

What E means in Diffie Hellman protocol?

I was looking for an example of protocol to verify user's identity using Diffie Hellman which works like this: client sends: $g^x$, ...
user avatar
  • 3
0 votes
2 answers
108 views

Why do we need to use Asymmetric cryptography if Diffie-Hellman solves the key exchange problem of symmetric cryptography?

I am new to cryptography and I cant get my head around this issue: If symmetric cryptography is faster then asymmetric and given that Diffie-Hellman key exchange algorithm allows you to exchange keys ...
user avatar
  • 47
1 vote
0 answers
26 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
user avatar
1 vote
1 answer
61 views

Sending encrypted message without public key from recipient (elgamal)

assume Bob and Alice use Elgamal encryption scheme. Alice wants to send Bob a message, but does not know Bobs public key. Is there a way for Alice to find out Bobs public key by receiving multiple ...
user avatar
1 vote
2 answers
111 views

Can a MITM during Diffie-Hellman key exchange manipulate both sides to generate symmetric secrets?

Is it possible for an attacker on a Diffie-Hellman key exchange to manipulate both sides in a way so that the secret generated on each side is identical? Or put differently, would it be possible to ...
user avatar
  • 13
2 votes
1 answer
75 views

Could anyone explain what Two Oracle Diffie-Hellman assumption is?

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already ...
user avatar
0 votes
1 answer
62 views

What's the meaning of asterisk and PPT in this paper?

I'm very new to cryptography. I'm required to read a paper. I totally don't understand. First, what's the meaning of the asterisk in $H:\{0,1\}^*\rightarrow \{0,1\}^k ?$. Second, what does PPT mean ...
user avatar
0 votes
1 answer
47 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
user avatar
1 vote
1 answer
54 views

Can Bob and Alice do an authenticated Diffie–Hellman key exchange if Bob only knows the hashsum of Alice's key?

Tor vanilla bridges look like this: Bridge x.x.x.x:1234 9DD03662B50FEDBF6F8D5630CB86D7E8CE4F4432 It's only the IP/Port and a hash of the key. Can Bob and Alice do an authenticated Diffie–Hellman key ...
user avatar
2 votes
1 answer
61 views

Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

Let's suppose that Bob has only Alice's IP and no more information about Alice's key, nor the digest of Alice's key. They exchange keys and need proof that the received keys are the same keys that ...
user avatar
1 vote
1 answer
76 views

Tree Parity Machines (neural cryptography) advantages

It seems that neural cryptography is an interesting research topic and there are some important contributions published in the last years. The proposed algorithms are suitable for symmetric key ...
user avatar
  • 11
0 votes
1 answer
98 views

64 bit key size Diffie Hellman

I am building a cryptographic El Gamal implementation on the Cardano Blockchain for a poker game. Each hand the players generate a DH 64 bit keys and shuffle the cards together via homomorphic ...
user avatar
  • 101
1 vote
1 answer
51 views

How do I ascertain the key length of some Diffie Hellman moduli to counteract the Log Jam vulnerability?

I have the following Diffie-Hellman ciphers on one of my servers ...
user avatar
1 vote
1 answer
42 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
user avatar
  • 51
1 vote
1 answer
47 views

Division by $2$ or principal root with DH oracle

Assume $g$ is generator of multiplicative group modulo prime $p=2q+1$ where $q$ is prime. Assume we know $g^{2t}\bmod p$ and $g^{2}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. ...
user avatar
  • 882
2 votes
1 answer
91 views

Breaking CDH also breaks DHI

I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
user avatar
  • 35
0 votes
1 answer
54 views

RSA Encryption and ECDH in OpenPGP

According to RFC4880 standard 1.Refer to section 2.1 Confidentiality via Encryption --> OpenPGP combines symmetric-key encryption and public-key encryption to provide confidentiality +To protect ...
user avatar
  • 51
0 votes
0 answers
13 views

Distributing the Master Public Key in Identity-based Encryption systems

I was just wondering how the private key generator should publish the master public key inside of an IBE system. This key is needed for all devices in the network to derive the public key of receiving ...
user avatar
0 votes
1 answer
39 views

What is the Diffie Hellman session key used for in IPsec protocol?

Let's say we choose AES as cryptographic algorithm for IPsec. My question is the following Is the key produced by Diffie-Hellman algorithm used as INPUT to the AES algorithm so AES does the ...
user avatar
2 votes
1 answer
123 views

Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
user avatar
1 vote
2 answers
62 views

Is there a standardized way to evaluate the security of a key exchange algorithm?

I'm now trying to design a more secure key-change algorithm to replace widely used DH. However, I am only able to prove that my algorithm is more secure logically, which means I can only prove it from ...
user avatar
  • 31
1 vote
2 answers
26 views

Definition of Multilin DDH

I am on the abbreviation mutlin. DDH, which probably stands for mutliniear Decision Diffie Hellmann. I am currently looking for a definition for this term, but unfortunately cannot find a source. Can ...
user avatar
  • 23
1 vote
2 answers
166 views

Definition of the strong Diffie Hellman problem

I am looking for the definition of the strong Diffie Hellmann problem. However, I can only find definitions for the $\ell$ or $q$-strong Diffie Hellmann. Is it possible that the strong Diffie Hellman ...
user avatar
  • 23
1 vote
1 answer
81 views

What is ECDH used for in BLE Authentication?

I am currently new to the world of BLE and I came across this article which mentions ECDH. In the diagram in part $3$, it generates the DHKey/shared secret (I am assuming this is the correct ...
user avatar
  • 111
4 votes
2 answers
2k views

I don't see how a ECDH is useful

I'm having a hard time understanding the usefulness of using an ECDH over traditional asymmetric encryption. Both parties have to exchange public keys to compute the ECDH, so why wouldn't they just ...
user avatar
  • 143
3 votes
2 answers
167 views

Common exponent problem related to discrete logarithms assuming Diffie Hellman oracle

Let $g$ be a generator of multiplicative group mod $p$ a prime. Suppose we know $$g^{a+km_1}\bmod p$$ $$g^{b-km_2}\bmod p$$ $$g^{a+k'm_3}\bmod p$$ $$g^{b-k'm_4}\bmod p$$ where $m_2m_3-m_4m_1=\phi(p)$ ...
user avatar
  • 882
4 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
user avatar
  • 63
2 votes
1 answer
67 views

How small is the negligible advantage for DDH?

The well known Decisional Diffie Hellman assumption (DDH) assert that for any $n = \log q$ and generator $g$ of $\mathbb{Z}_q$, for uniformly i.i.d $A, B, C \sim U(\mathbb{Z}_q)$, the following are ...
user avatar
  • 113
1 vote
1 answer
78 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
user avatar
0 votes
1 answer
21 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8 in ACVP

Hi I found this question which I am currently struggling with. How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8? In ACVP, the input diffe-hellman shared secret ...
user avatar
  • 1
1 vote
1 answer
81 views

On access to a Diffie Hellman oracle

Assume $g$ is generator of multiplicative group modulo prime $p$. Assume we know $g^X\bmod p$ and $g^{XY}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. Can we find $g^Y\bmod p$ in ...
user avatar
  • 882
0 votes
0 answers
52 views

Security of a variant of DDH

The standard DDH assumption states that given $(g,g^a,g^b,g^c)$, it is hard to determine whether $c$ is $ab$ or not. A variant of DDH assumption is: given $(g,g^a,g^b,g^c, g^{ab} ,g^{bc},g^{ac})$, it ...
user avatar
1 vote
2 answers
127 views

Symmetric key generation for ECDH

Trying to implement a mechanism for one way transmission of encrypted string values using ECC. Assume there is a fixed secret unavailable private key FPK, and public key FP for it is available to the ...
user avatar
1 vote
1 answer
184 views

Security of McCallum-Relyea exchange

I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key. It was developed at RedHat and is used by the tang and clevis ...
user avatar
  • 258
0 votes
0 answers
68 views

Proving a variation of CDH is hard

let $(\mathbb{G},q,p)$ be a group $\mathbb{G}$ with prime order $q$ and generator $g$. Assume that CDH is hard relative to this setup (Namely, given $(g,g^a,g^b)$, it is hard to find $g^{ab}$). Now ...
user avatar
  • 21
2 votes
1 answer
200 views

Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
user avatar
  • 23
2 votes
1 answer
257 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
user avatar
  • 45
0 votes
1 answer
60 views

ECDHE without initial handshake

Is it possible to do a key agreement with ECDH ephemeral-ephemeral without requiring an initial handshake first? Is it possible to have the key agreement in the same message as the encrypted data with ...
user avatar
0 votes
0 answers
36 views

Consequences of leaking one byte of an ECDH shared secret

An EC point $B$ is published publicly so that a recipient in possession of a scalar $a$ can calculate the shared secret $S = [a]B$. This is done with the Ed25519 curve. If the sender (who knows $b$ ...
user avatar
  • 2,698
1 vote
0 answers
35 views

Performance of elliptic curve Diffie-Hellman vs NIST-PQC finalist KEMS

I am looking for performance measurements in cycle counts for an implementation of the elliptic curve Diffie-Hellman for curve, ed25519. Ideally, the cycle counts ...
user avatar
1 vote
1 answer
373 views

Can Fixed–Diffie–Hellman be attacked?

Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
user avatar
  • 113
0 votes
0 answers
51 views

Is it possible to create an algorithm for identification and key exchange using the diffie hellman algorithm with exactly three messages?

Suppose I want to create a new protocol for communication between two sides, I want to use the Diffie hellman protocol for exchanging keys & also want to do a few more steps later so that the ...
user avatar
  • 13
0 votes
0 answers
65 views

Avoid MITM Attack in ECDH Without HTTPS or a Third Party Certificate Authority

My context: I have a ECHD protocol, my main concern is MITM attack, it doesn't matters if you do HMAC or anything else in future to sign requests if your key exchange is compromised, Far from https ...
user avatar
1 vote
2 answers
60 views

Use of custom DH parameters for TLS decryption

There are several ways to decrypt TLS e.g. in an enterprise environment. I did not see using "backdoored" DH parameters being mentioned somewhere though according to my understanding it ...
user avatar
1 vote
2 answers
97 views

How to find the extractor in the Knowledge-of-Exponent Assumption?

From Mihir Bellare's paper Let $q$ be a prime such that $2q +1$ is also prime, and let $g$ be a generator of the order $q$ subgroup of ${Z^∗}_{2q+1}$. Suppose we are given input $q$, $g$, $g^a$ and ...
user avatar
  • 1,637

1
2 3 4 5
20