Questions tagged [diffie-hellman]
The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.
1,076
questions
1
vote
1
answer
66
views
Is it possible to use Diffie-Hellman protocol for symmetric group?
I was asked this question during one of my first cryptography classes, and I'm not sure if I understand it correctly. To begin, I know that after using the Diffie-Hellman protocol (which itself is ...
- 11
-2
votes
0
answers
37
views
1
vote
1
answer
56
views
What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?
I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in
Small sub group ...
- 11
0
votes
0
answers
30
views
Sending public key trough untrusted server
I am developing end-to-end encrypted chat system (which is open-source). When I want to give other client my public key, I need to send it trough server, right? I want to make sure no one can edit the ...
- 1
1
vote
0
answers
61
views
Curve448 ECC parameters for use with OpenSSL
I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
0
votes
1
answer
85
views
A simple guide to Diffie-Hellman Key Exchange including the what, the how and the why
I'm tired of going online looking for a simple explanation of how the Diffie-Hellman Key Exchange works. Many guides I've found attempt to explain it using anything from "paint" to massive ...
- 103
1
vote
2
answers
69
views
App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure
I have this uni project that I have to implement in code:
"App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
3
votes
1
answer
191
views
Can DH be used for privacy-preserving proof of possession?
First time question poster so I hope the below is clear enough :).
Problem summary: Can a Holder and Verifier safely use ECDH for a Challenge-Response protocol where:
the Holder proves possession and ...
- 121
0
votes
1
answer
52
views
TLS 1.3 digital certificates and ephemeral Diffie Hellman
There is a lot of confusing information out there regarding the role of digital certificates and the use of Ephimeral Diffie Hellman in how TLS 1.3 operates.
Would it be correct to state that the the ...
- 1
0
votes
0
answers
52
views
Inquiries on Strong Diffie-Hellman assumption
According to the SDH assumption, it is hard for an adversary to output a pair $(c,g_1^{\frac{1}{c+\alpha}})$ given a $q+2$ tuple ($g_1$,$g_2$,$g_2^{\alpha}$, ...,$g_2^{{\alpha}^q}$)
Now, consider $g_1$...
0
votes
0
answers
46
views
Secure key exchange for custom USB device
I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication.
I studied TLS 1.2 key exchange but ...
2
votes
2
answers
85
views
One group element hybrid encryption for El Gamal
I am really curious about this one problem 10.12 from Katz/Lindell's book. It goes as follows:
I am quite sure we can assume that $\textsf{Enc}_k(m) \in \mathbb{G}$, as the authors devoted the whole ...
1
vote
1
answer
24
views
Use of CertificateVerify in TLS_DH_RSA with client authentication?
Does anyone know if CertificateVerify is sent in TLS_DH_RSA with client authentication? Does anyone know the RFC or could explain the meaning of it? With TLS_RSA, a ...
- 21
1
vote
1
answer
81
views
Signed vs unsigned prekeys
I am trying to understand the signal protocol better. I spend some time trying to understand their codebase (the backend is written in java).
The signal protocol indicates that the user has to upload ...
- 111
1
vote
2
answers
158
views
Is this self algorithm made private key for Diffie-Hellman key exchange secure
i created a function in javascript that creates my a for the DH exchange like this:
...
1
vote
1
answer
61
views
Similar to Diffie Hellman for BLS in asymmetric pairing?
I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
- 601
0
votes
0
answers
83
views
Generating a new curve using an existing curve and new prime
Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user113099
2
votes
3
answers
219
views
Is any safe prime sufficient for a secure DH key exchange?
There are some very large safe primes listed here: https://en.wikipedia.org/wiki/Safe_and_Sophie_Germain_primes
Would using any of them result in a secure DH construction? Generator is 2.
The exponent ...
user113099
2
votes
0
answers
69
views
Tor Key Exchange Client - Middle Node
I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
- 21
0
votes
0
answers
52
views
which DH protocol is safer in communication with given condition?
I am trying to understand some concepts such as DH problem and its variants. I have the following question from the book I read. (note that I translated the question from my language to english)
...
user115992
0
votes
2
answers
353
views
Are Safe and Sophie Germain primes evenly distributed?
Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value?
This is important in one area of triangular ...
0
votes
0
answers
76
views
Distinguishing between two DDH-like tuples
Given a group generator $g$ (in a group where DDH is hard). Let $X_1=g^{x_1}$ and $X_2=g^{x_2}$ be two public elements, where $x_1$ and $x_2$ are selected randomly and kept secret.
Consider a game ...
- 99
1
vote
0
answers
69
views
Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?
Motivation
I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
- 1,741
1
vote
1
answer
371
views
DHKE: Why using safe prime gives us "safe" subgroups?
I come from the question here: Safe primes subgroup in Diffie–Hellman key exchange
Where the accepted answer states that there are only 4 possible outcomes for the order of a subgroup when using a ...
- 175
3
votes
2
answers
169
views
What is the difference between Post-Compromise Security and Backward Security?
Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain ...
- 31
3
votes
1
answer
151
views
Separation between CDH and DDH
Do there exist cryptographic primitives that have proved that they cannot be constructed from CDH assumption only but can from DDH assumption?
More generally, do there exist cryptographic primitives ...
- 33
1
vote
1
answer
104
views
How often do Double ratchet in Signal protocol update DH ratchet key
I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet.
According to wiki:
A client renews session key material in interaction with the remote
peer using ...
- 429
4
votes
1
answer
363
views
How does the Legendre symbol reveal if $g^a$ is odd or even for Finite Field Diffie-Hellman
According to wikipedia(markdown is striped below) for Decisional Diffie–Hellman assumption:
the DDH assumption does not hold in the multiplicative group $Z(p)$,
where $p$ is prime. This is because if ...
- 429
0
votes
1
answer
152
views
Safe primes subgroup in Diffie–Hellman key exchange
I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki:
The order of G should have a large prime factor to prevent use of the
Pohlig–Hellman ...
- 429
0
votes
0
answers
53
views
Could ECDH-OPRF-PSI support private information retrieval？
Alice：has $x=(x_1，x_2,...x_m)$
Bob: has $(y_1,m_1),...,(y_n,m_n)$
For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets
Bob generate random $a \in Z_q$，$...
- 21
1
vote
2
answers
99
views
Efficiently detect that a ciphertext is meant for Alice
Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
user80785
0
votes
1
answer
73
views
Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]
I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
- 33
1
vote
2
answers
318
views
Why does ECIES use "Key Encapsulation"? Does it?
In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
- 92.6k
1
vote
1
answer
148
views
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides?
For example can I use secp521r1 at the ...
- 33
0
votes
1
answer
69
views
On a problem assuming Diffie-Hellman oracle
If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$.
Can we construct $g^{x^{-1}}$ given $g^x$?
- 908
2
votes
1
answer
109
views
Is Message Layer Security the state of art protocol for group encryption?
I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or ...
- 83
2
votes
1
answer
415
views
What is the correct way to use HKDF with X25519?
I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF.
Initially, I ...
- 31
3
votes
1
answer
268
views
Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?
Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs:
NodeJS:
...
- 918
1
vote
2
answers
284
views
What's the catch with this Diffie-Hellman based cryptosystem?
This is most likely a dumb question. I'm doing a mathematical research project that overflowed a bit into cryptography. It got me thinking about something. Can the following cryptosystem work?
Let ...
- 113
0
votes
0
answers
136
views
Which encryption/decryption to use with ECC?
I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
- 1
3
votes
1
answer
127
views
Big prime factor of the prime number you feed to Diffie Hellman
They say the security of Diffie-Hellman depends on the factorization of (N-1), where N is the big prime number you feed it.
More specifically, (N-1) itself has to have a big prime factor, such as (N-1)...
- 139
1
vote
1
answer
117
views
Is it possible to have a shared secret between an unlimited number of parties asynchronously?
Let's say I encrypt a message with some secret and store it in a database. Later, I want to securely share that secret with someone, so that they can read the message as well. Even later, I want to ...
- 111
1
vote
1
answer
89
views
Diffie-Hellman key exchange for $n + 1$ parties
Suppose that there are $n+1$ parties - $B,A_1,A_2,...,A_n$ that want to share a secret key
The protocol of exchanging is roughly the same as Diffe-Hellman
Chose a group $G$ with an order of $p$ - a ...
- 113
0
votes
1
answer
53
views
(type-3) Variant of the decisional Diffie-Hellman
At a high level, the Uber assumption states that it is not possible to compute (distinguish) linearly independent elements. In the decisional version, the problem is restricted to $G_T$, but it is ...
- 1
0
votes
2
answers
92
views
Key exchange from discrete logarithm only
Diffie-Hellman key exchange is sometimes informally said to be hard under the discrete logarithm assumption in the chosen group. But if I am reading literature correctly, it actually uses a stronger ...
- 233
1
vote
1
answer
195
views
Why is static-static diffie hellman needed in Noise_IK?
TL;DR: Why is there a static-static diffie hellman in the Noise_IK handshake?
Hi,
I am currently trying to understand the WireGuard VPN protocol.
As you may know, it uses the Noise_IK handshake from ...
- 13
3
votes
1
answer
505
views
How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?
In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
- 33
5
votes
2
answers
198
views
Authenticated encryption scheme for one-way radio telemetry
I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
- 3,527
3
votes
2
answers
210
views
"Supported groups" in RFC 8446 (TLS 1.3)
What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446:
/* Finite Field Groups (DHE) */
ffdhe2048(0x0100), ffdhe3072(0x0101), etc:
Is the digits - ...
- 95
3
votes
1
answer
757
views
How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?
Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it.
My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
- 33