Questions tagged [diffie-hellman]
The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.
1,095
questions
1
vote
1
answer
31
views
EC private key check value by ECDH against base point
I am designing a general purpose software security module.
One of my requirements is to "describe" a stored key, including a "check" value. The purpose of this "check" ...
- 113
1
vote
1
answer
172
views
When was EDH key exchange introduced to SSL/TLS?
I'm putting together a talk on the history of SSL/TLS and one detail I can't find info on is when DHE key exchange was introduced. If someone was able to point to an RFC or OpenSSL version that would ...
- 125
1
vote
1
answer
45
views
Why MDDH is DDH when k in Matrix D is 1?
I am reading a paper Multi-authority ABE for Non-monotonic Access Structures, when the author defines the DDH problem in preliminaries. The definition is
I find it is a type of Matrix DDH when $k=1$....
0
votes
1
answer
25
views
Randomizability of a signature scheme and the DDH problem
I am currently studying the so-called PS-signature and its property of being randomizable. In short, a PS-signature on a message $m$ is a tuple $(h, h^{x+ym}) \in \mathbb{G_1}\times \mathbb{G_1}$, ...
- 11
1
vote
1
answer
37
views
secure channel for sending partial private keys!
In certificateless cryptography, the KGC must ensure that the partial private keys are delivered securely to the correct entities.
So my question is how KGC can send these keys secretly?
In the other ...
- 31
0
votes
0
answers
25
views
Sending long-term DH public keys via a one-time-use DH key pair
I am developing a hobby project - a secure chatroom system, where I've developed a BigNum arithmetic library and a cryptography library in C from scratch, and coming up with a theoretical scheme that ...
- 159
0
votes
0
answers
31
views
Consequences of breaking Diffie-Hellman to factoring
According to the answer in What are the consequences of Diffie Hellman problem in P?, it appears we believe Discrete Logarithm and Diffie-Hellman are equivalent problems.
We also know if Discrete ...
- 972
1
vote
2
answers
205
views
Why using q = (p - 1)/2 for discrete log Diffie-Hellman scalar operations and not p?
As defined in RFC 3526 the prime $p$ and generator $g$ are known. The prime $p$ defined there is a safe prime, which can also be expressed as $p=2q+1$ with $q$ prime. The amount of elements in this ...
- 133
1
vote
1
answer
163
views
DH Encrypt by XOR
I'm working in the Curve25519 domain (EC curve, 256-bit key size).
I have a peer pubkey, and need to send it an encrypted message.
For starters we create a "nonce" (ephemeral key), and use ...
- 359
1
vote
1
answer
301
views
How do I find the order of the subgroup in a Diffie-Hellman key exchange?
I'm implementing the Diffie-Hellman key exchange as specified in RFC 4253 for SSH.
Here's an extract from the RFC:
The following steps are used to exchange a key. In this, C is the client; S is the ...
1
vote
0
answers
52
views
Proof that Inverse CDH and Square CDH are equivalent
I am trying to prove said equivalence, but when proving SCDH -> ICDH using a reduction, I get stuck since I don't know how to compute $g^{x^2}$ starting from $g^{x^{-1}}$.
Suppose exists $A_{ICDH}$ ...
1
vote
0
answers
67
views
Is the following Inverse Computational co-Diffie-Hellman problem hard?
Let $\langle g \rangle \stackrel{\Delta}{=} \mathbb{G}$ and $\langle h \rangle \stackrel{\Delta}{=} \mathbb{H}$ be groups of prime order $p$. Given $( p, g, g^\delta, g^{\delta^{-1}}, h, h^\delta )$, ...
0
votes
0
answers
17
views
Safety per bit DHKA and ECDH
I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
- 1
0
votes
0
answers
34
views
Is the MITM protection provided by BLE LESC passkey mechanism bidirectional?
I'm trying to understand whether the passkey mechanism described in BLE LESC pairing provides bidirectional MITM protection.
As far as I understand, A and B will generate the same shared secret using ...
0
votes
1
answer
67
views
diffie hellman key exchange compared with ECDH [closed]
I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
- 1
0
votes
0
answers
38
views
How some auxiliary information influence the CDH assumption?
I am proposing a multi-party group-key agreement protocol in my paper, which can be seen as an extension of the classic Diffie Hellman bipartite group key agreement. However, how to formalize the ...
- 1
0
votes
1
answer
57
views
Is shared secret and SKEYID are same in the IPSec?
I want to know that, is shared secret and SKEYID are same in the IPSec? I knew that from SKEYID, three further keys are generated (derivative, authentication and encryption). But from where this ...
4
votes
2
answers
115
views
How do I solve a discrete log using pen paper for exam without bruteforcing it?
I have my Network Security finals. In elgamal cryptosystem, I am often encountering these equations like this
3 = (10^XA) mod 19
now everywhere I am finding only ...
- 141
6
votes
3
answers
4k
views
Why does it take longer to generate suitably large primes for Diffie-Hellman key exchange as opposed to for RSA encryption / decryption?
For RSA, we need two primes p and q to define N = pq. We will only look how long it takes to generate a prime for p because the process is similar for q.
From my lecture slides, my professor states ...
- 63
1
vote
1
answer
73
views
Is it possible to use Diffie-Hellman protocol for symmetric group?
I was asked this question during one of my first cryptography classes, and I'm not sure if I understand it correctly. To begin, I know that after using the Diffie-Hellman protocol (which itself is ...
- 11
1
vote
1
answer
99
views
What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?
I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in
Small sub group ...
- 11
0
votes
0
answers
37
views
Sending public key trough untrusted server
I am developing end-to-end encrypted chat system (which is open-source). When I want to give other client my public key, I need to send it trough server, right? I want to make sure no one can edit the ...
- 1
1
vote
0
answers
163
views
Curve448 ECC parameters for use with OpenSSL
I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
2
votes
2
answers
111
views
On a diffie hellman related oracle
Given an oracle that can compute $g^{x^{-1}}\bmod p$ from $g^x\bmod p$ is it possible to compute $g^{x^2}\bmod p$ in polynomial time ($p$ is a prime and $g$ generates the multiplicative group modulo $...
- 972
2
votes
1
answer
454
views
A simple guide to Diffie-Hellman Key Exchange including the what, the how and the why
I'm tired of going online looking for a simple explanation of how the Diffie-Hellman Key Exchange works. Many guides I've found attempt to explain it using anything from "paint" to massive ...
- 152
1
vote
2
answers
73
views
App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure
I have this uni project that I have to implement in code:
"App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
3
votes
1
answer
207
views
Can DH be used for privacy-preserving proof of possession?
First time question poster so I hope the below is clear enough :).
Problem summary: Can a Holder and Verifier safely use ECDH for a Challenge-Response protocol where:
the Holder proves possession and ...
- 121
0
votes
1
answer
67
views
TLS 1.3 digital certificates and ephemeral Diffie Hellman
There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates.
Would it be correct to state that the the ...
- 11
0
votes
0
answers
57
views
Inquiries on Strong Diffie-Hellman assumption
According to the SDH assumption, it is hard for an adversary to output a pair $(c,g_1^{\frac{1}{c+\alpha}})$ given a $q+2$ tuple ($g_1$,$g_2$,$g_2^{\alpha}$, ...,$g_2^{{\alpha}^q}$)
Now, consider $g_1$...
0
votes
0
answers
64
views
Secure key exchange for custom USB device
I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication.
I studied TLS 1.2 key exchange but ...
2
votes
2
answers
103
views
One group element hybrid encryption for El Gamal
I am really curious about this one problem 10.12 from Katz/Lindell's book. It goes as follows:
I am quite sure we can assume that $\textsf{Enc}_k(m) \in \mathbb{G}$, as the authors devoted the whole ...
1
vote
1
answer
31
views
Use of CertificateVerify in TLS_DH_RSA with client authentication?
Does anyone know if CertificateVerify is sent in TLS_DH_RSA with client authentication? Does anyone know the RFC or could explain the meaning of it? With TLS_RSA, a ...
- 21
1
vote
1
answer
113
views
Signed vs unsigned prekeys
I am trying to understand the signal protocol better. I spend some time trying to understand their codebase (the backend is written in java).
The signal protocol indicates that the user has to upload ...
- 111
1
vote
2
answers
161
views
Is this self algorithm made private key for Diffie-Hellman key exchange secure
i created a function in javascript that creates my a for the DH exchange like this:
...
1
vote
1
answer
71
views
Similar to Diffie Hellman for BLS in asymmetric pairing?
I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
- 631
0
votes
0
answers
85
views
Generating a new curve using an existing curve and new prime
Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user113099
2
votes
3
answers
263
views
Is any safe prime sufficient for a secure DH key exchange?
There are some very large safe primes listed here: https://en.wikipedia.org/wiki/Safe_and_Sophie_Germain_primes
Would using any of them result in a secure DH construction? Generator is 2.
The exponent ...
user113099
2
votes
0
answers
81
views
Tor Key Exchange Client - Middle Node
I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
- 21
0
votes
0
answers
52
views
which DH protocol is safer in communication with given condition?
I am trying to understand some concepts such as DH problem and its variants. I have the following question from the book I read. (note that I translated the question from my language to english)
...
user115992
0
votes
2
answers
418
views
Are Safe and Sophie Germain primes evenly distributed?
Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value?
This is important in one area of triangular ...
0
votes
0
answers
84
views
Distinguishing between two DDH-like tuples
Given a group generator $g$ (in a group where DDH is hard). Let $X_1=g^{x_1}$ and $X_2=g^{x_2}$ be two public elements, where $x_1$ and $x_2$ are selected randomly and kept secret.
Consider a game ...
- 99
1
vote
0
answers
70
views
Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?
Motivation
I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
- 1,751
1
vote
1
answer
412
views
DHKE: Why using safe prime gives us "safe" subgroups?
I come from the question here: Safe primes subgroup in Diffie–Hellman key exchange
Where the accepted answer states that there are only 4 possible outcomes for the order of a subgroup when using a ...
- 175
3
votes
2
answers
282
views
What is the difference between Post-Compromise Security and Backward Security?
Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain ...
- 31
3
votes
1
answer
170
views
Separation between CDH and DDH
Do there exist cryptographic primitives that have proved that they cannot be constructed from CDH assumption only but can from DDH assumption?
More generally, do there exist cryptographic primitives ...
- 33
1
vote
1
answer
130
views
How often do Double ratchet in Signal protocol update DH ratchet key
I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet.
According to wiki:
A client renews session key material in interaction with the remote
peer using ...
- 459
4
votes
1
answer
419
views
How does the Legendre symbol reveal if $g^a$ is odd or even for Finite Field Diffie-Hellman
According to wikipedia(markdown is striped below) for Decisional Diffie–Hellman assumption:
the DDH assumption does not hold in the multiplicative group $Z(p)$,
where $p$ is prime. This is because if ...
- 459
0
votes
1
answer
196
views
Safe primes subgroup in Diffie–Hellman key exchange
I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki:
The order of G should have a large prime factor to prevent use of the
Pohlig–Hellman ...
- 459
0
votes
0
answers
66
views
Could ECDH-OPRF-PSI support private information retrieval？
Alice：has $x=(x_1，x_2,...x_m)$
Bob: has $(y_1,m_1),...,(y_n,m_n)$
For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets
Bob generate random $a \in Z_q$，$...
- 21
1
vote
2
answers
103
views
Efficiently detect that a ciphertext is meant for Alice
Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
user80785