# Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

637 questions
61 views

### How is the recommended NIST modulus for DLP chosen/calculated?

NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. From this answer it appears that the range of private key numbers is derived by calculating a prime modulus via $2⋅p$ ...
32 views

160 views

### Why do elliptic curves require fewer bits for the same security level?

I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits. For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic ...
46 views

### How to multiply two Public Keys in Elliptic Curve in Go

I am working on a messaging client similar to Signal. I am stuck on implementing Tripartite Diffie-Hellman handshake in which three DH exchanges are combined to authenticate both parties and produce ...
966 views

### Are CDH and Square-DH equally hard?

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $\operatorname{CDH}(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ ...
191 views

### Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
66 views

### Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?

I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
34 views

### Prove that a signature scheme is RUF-NMA and not EUF-CMA

I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
298 views

### Signal Protocol: What extra features does double ratchet algorithm add to Diffie-Hellman ratchet?

I have been reading the documentation of Signal protocol and could not find out why they came up with double ratchet instead of using Diffie-Hellman ratchet which was available at first place in OTR?
5k views

### How is session key generated for TLS?

I would like to understand better what happens during establishment of SSL/TLS secure connection. The Client wants to establish a connection - ClientHello The server answers with a ServerHello. This ...
164 views

### Using Diffie-Hellman secret key to encrypt/decrypt data?

My end goal is to encrypt data with AES-128, send it to other process and decrypt it there. While using DH key exchange protocol. I have used DH to generate a 256 bytes shared secret, but I can't use ...
263 views

### Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
98 views

### GPG encrypt performance degradence for thousands receipients [closed]

I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands). I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist ...
2k views

### Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
38 views

### Key confirmation and other benefits of double ratchet

I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting. This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...