Questions tagged [diffie-hellman]
The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.
1,050
questions
1
vote
2
answers
78
views
Efficiently detect that a ciphertext is meant for Alice
Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
- 315
0
votes
1
answer
51
views
Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]
I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
- 33
1
vote
2
answers
125
views
Why does ECIES use "Key Encapsulation"? Does it?
In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
- 91.1k
1
vote
1
answer
60
views
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides?
For example can I use secp521r1 at the ...
- 33
0
votes
1
answer
56
views
On a problem assuming Diffie-Hellman oracle
If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$.
Can we construct $g^{x^{-1}}$ given $g^x$?
- 908
1
vote
0
answers
50
views
Is Message Layer Security the state of art protocol for group encryption?
I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or ...
- 63
2
votes
1
answer
110
views
What is the correct way to use HKDF with X25519?
I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF.
Initially, I ...
- 31
3
votes
1
answer
216
views
Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?
Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs:
NodeJS:
...
- 835
1
vote
2
answers
248
views
What's the catch with this Diffie-Hellman based cryptosystem?
This is most likely a dumb question. I'm doing a mathematical research project that overflowed a bit into cryptography. It got me thinking about something. Can the following cryptosystem work?
Let ...
- 113
0
votes
0
answers
80
views
Which encryption/decryption to use with ECC?
I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
- 1
3
votes
1
answer
86
views
Big prime factor of the prime number you feed to Diffie Hellman
They say the security of Diffie-Hellman depends on the factorization of (N-1), where N is the big prime number you feed it.
More specifically, (N-1) itself has to have a big prime factor, such as (N-1)...
- 129
0
votes
1
answer
70
views
Is it possible to have a shared secret between an unlimited number of parties asynchronously?
Let's say I encrypt a message with some secret and store it in a database. Later, I want to securely share that secret with someone, so that they can read the message as well. Even later, I want to ...
- 101
1
vote
1
answer
66
views
Diffie-Hellman key exchange for $n + 1$ parties
Suppose that there are $n+1$ parties - $B,A_1,A_2,...,A_n$ that want to share a secret key
The protocol of exchanging is roughly the same as Diffe-Hellman
Chose a group $G$ with an order of $p$ - a ...
- 113
0
votes
1
answer
45
views
(type-3) Variant of the decisional Diffie-Hellman
At a high level, the Uber assumption states that it is not possible to compute (distinguish) linearly independent elements. In the decisional version, the problem is restricted to $G_T$, but it is ...
- 1
0
votes
2
answers
73
views
Key exchange from discrete logarithm only
Diffie-Hellman key exchange is sometimes informally said to be hard under the discrete logarithm assumption in the chosen group. But if I am reading literature correctly, it actually uses a stronger ...
- 223
1
vote
1
answer
84
views
Why is static-static diffie hellman needed in Noise_IK?
TL;DR: Why is there a static-static diffie hellman in the Noise_IK handshake?
Hi,
I am currently trying to understand the WireGuard VPN protocol.
As you may know, it uses the Noise_IK handshake from ...
- 13
3
votes
1
answer
446
views
How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?
In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
- 33
5
votes
2
answers
171
views
Authenticated encryption scheme for one-way radio telemetry
I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
- 3,517
2
votes
2
answers
158
views
"Supported groups" in RFC 8446 (TLS 1.3)
What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446:
/* Finite Field Groups (DHE) */
ffdhe2048(0x0100), ffdhe3072(0x0101), etc:
Is the digits - ...
- 85
3
votes
1
answer
338
views
How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?
Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it.
My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
- 33
2
votes
1
answer
44
views
Two way key transport?
For a KEM mechanism like RSA, Kyber, etc. is there it usually worth doing key trapping/key encapsulation both directions in a key exchange? By this I mean: Alice wraps a symmetric key and sends it to ...
- 73
3
votes
1
answer
72
views
Is there a standard I can test a ECDH against?
I have a program in Python to do the ECDH with the NIST P-256 curve. The program is seemingly working, ie I get the same private key pair at the end. But I want to make sure it's not a coincidence in ...
- 91
1
vote
1
answer
73
views
DH Finding A Public Key from Public key and shared secret
Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair?
This would be rarely useful, but I am curious if the DH ...
- 33
2
votes
1
answer
356
views
Is pairing-based crypto post-quantum secure?
Bilinear Pairings are widely used in many new schemes like Group Signature and Aggregate Signature. The problem is whether it is post-quantum secure. In other words, does Bilinear Diffie-Hellman ...
- 63
6
votes
1
answer
484
views
What's wrong with this simple reduction of discrete logarithms to the Diffie-Hellman problem?
This recent paper shows that discrete logarithms are solvable if you have an oracle for the Diffie–Hellman problem. However, to me, it seems there is a much simpler reduction and I wonder where I am ...
- 339
3
votes
0
answers
115
views
Compute key size in Hyperelliptic Curve Cryptography
I am trying to implement a basic Diffie-Hellman key exchange using ECC and HECC of genus 2 and 3 and compare them. However, I am a bit confused about the concept of key size in HECC.
In ECC, from my ...
- 61
1
vote
0
answers
43
views
How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]
Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known.
Assuming that it is possible to exchange ...
- 11
0
votes
1
answer
158
views
ECDH security vs. type of elliptic curve
While using ECDH key exchange, we can choose to use different kind of elliptic curve, e.g. P224, P256 or P384 etc. (btw, I am using go).
My question is, what is the criteria to choose different kind ...
- 139
1
vote
0
answers
35
views
How to design a Zero-Knowledge Proof of a message in a certain range? [duplicate]
Given a message $m$, how can I prove that $m$ lies between 0 and 31 without revealing the message using a Sigma protocol?
The message is encrypted as:
$$c = a^{\beta} \cdot g^m ,$$
where:
$a$ is the ...
- 11
2
votes
0
answers
42
views
A tensor-based Diffie-Hellman exchange
Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions:
References for something similar?
Obvious flaws, is this a terrible ...
- 327
1
vote
0
answers
89
views
How to combine the keys in the Triple Diffie-Hellman (3DH) key exchange?
I was reading up on the Triple Diffie-Hellman (3-DH) key exchange and noticed that the wikipedia description [1] is different from the the original protocol definition [2] and the modified definition [...
- 435
2
votes
1
answer
264
views
Why must ECDSA verification ensure the point is on the curve?
In ECDSA, when parsing the public key a test is made to ensure the public key really lies on the curve. What vulnerabilities appear if one does not do this?
- 73
0
votes
0
answers
41
views
Could Diffie-Hellman ciphertext be used as OPRF(Oblivious pseudorandom functions) input?
In my recent PSI project, I wanted to use Diffie-Hellman encryption to obtain ciphertext as OPRF input, but I could not find similar work related to it.
In my opinion, Diffie-Hellman ciphertext length ...
- 11
1
vote
0
answers
33
views
Variant of Decisional Diffie Hellman
Given a cryptographic prime $p$ and a generator $g$ of $\mathbb{F}_p$, the Decisional Diffie Hellman problem asks us to distinguish
$(g^a, g^b, g^{ab})$ from $(g^a, g^b, g^z)$ for random $a, b, z$. ...
- 115
2
votes
1
answer
45
views
Upper bound for the Gap Diffie–Hellman (in the generic group model)
Does it exist an upper bound for the advantage of solving the Gap Diffie-Hellman problem (possibly expressed in terms of the order of the group, number of queries to the oracle, time, etc.)?
- 21
2
votes
2
answers
127
views
Does partial public key pre-sharing and partial public key exchange improve security vs one-sided public key sharing
I have a small ARM M0 SoC and a smartphone as actors. Encryption keys used are Elliptic curve.
My current security is implemented such that:
the SoC has 128 bit hashes of phone public keys (vs 512 ...
- 121
3
votes
0
answers
78
views
Solving DDH from an ElGamal adversary
Suppose an adversary wins IND-CPA against ElGamal,
They're given public key $h=g^x$,
Give a pair of messages $m = [m0,m1]$,
Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$,
from which ...
- 83
1
vote
0
answers
259
views
How to calculate points for twist?
How I can find the point to perform this twist attack - https://cryptodeep.ru/twist-attack/
English version of previous link:
https://github.com/demining/Twist-Attack
This video has additional ...
- 29
2
votes
2
answers
213
views
ECDH between identical public keys
We are using libsodium and regarding exchanging secrets we would like to use the so-called crypto_box (https://libsodium.gitbook.io/doc/public-key_cryptography/authenticated_encryption). Under the ...
- 21
5
votes
2
answers
410
views
DDH hardness with shared public parameters
DDH is believed hard for subgroup of $ℤ^*_p$ with order $q=(p-1)/2$ when $p$ is a safe prime chosen randomly.
What if $p$ isn't random: When parameters are shared, $p$ mightn't have been chosen ...
- 83
1
vote
1
answer
128
views
McCallum-Relyea exchange on x25519 elliptic curve
Background
I have a degree in electronics engineering, I'm not bad at programming with many languages, but I'm not that good at cryptography, I'm just able to use that from libraries, and I understand ...
2
votes
2
answers
1k
views
How does perfect forward secrecy work for messaging?
I am struggling to understand how messaging protocols (like Signal) are able to use perfect forward secrecy. My understanding is that the server generates temporary keys which are used in combination ...
- 45
4
votes
1
answer
68
views
Does $X \rightarrow y$ being CDH imply that, given $X$ distinguishing between $y, r$ is DDH $\forall r\in Z_{p}^{*}$
In one proof I show that, given a cyclic group $Z_{p}^{*}$ where $p$ is prime, and a set of information $X$ computing $y\in Z_{p}^{*}$ is as difficult as solving Computational Diffie Hellman (CDH) ...
- 153
0
votes
0
answers
19
views
How should we take the value of K in small subgroup confinment attack on diffie hellman
In small subgroup confinement attack in diffie hellman, what are the rules to calculate the value of K
Is there any rules about the order of the subgroup which we will be choosing to perform the ...
- 21
3
votes
2
answers
159
views
How to distinguish X25519 output from random?
Suppose that Alice has an X25519 key pair $\{S_A,P_A\}$ (secret and public key, respectively). Using randomly selected X25519 public keys $\{P_*\}$ (such that $P_A\notin \{P_*\}$), Alice calculates ...
- 257
2
votes
1
answer
76
views
Is it safe to use ECDH shared secret as a simple authentication cookie?
The protocol would look like this:
User creates account and provides username, static public key
User logs in by sending username
Server responds by sending an ephemeral public key
For the duration ...
- 245
9
votes
2
answers
2k
views
How many valid X25519 private keys are there?
According to the Curve25519 website:
Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
- 257
1
vote
0
answers
48
views
ddh and statistical distance
Let $\mathbb{G}$ be a cyclic group of prime order q and generated by g. Let $D$ be the uniform distribution over $\mathbb{G}^3$. Let $D_{dh}$ be the uniform distribution over the set of all DH-triples ...
- 73
2
votes
1
answer
65
views
What is the purpose of "q" in Safe Prime definition during key pair generation?
Consider the following case, given x(private key) and y(public key), how to determine whether this key pair is generated by a pre-defined Safe Prime Group(Say FFDHE, RFC 7919)?
In context of SP800 ...
- 33
1
vote
0
answers
71
views
Small Subgroup confinement Attack Diffie Hellman
In small subgroup confinement attack we are taking k (the power which Eve will use to be)
k = (p-1)/w
where p-1 is the order of the group on which Alice and Bob is ...
- 21