Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

2
votes
1answer
52 views

Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not: 1) Alice and Bob each generate a ...
3
votes
3answers
63 views

Establish more secure symmetric crypto system given A and B have small initial secret

Alice and Bob have a secret number X that is known only to them. However, the number is only 14 bits, and Trudy knows they share such a secret and can intercept messages between them. Instead of using ...
3
votes
0answers
65 views

Distribution of randomness in elliptic curve Diffie-Hellman shared secret

The specification for a project I'm working on says to use elliptic curve Diffie-Hellman for key exchange, specifically using the secp224r1 curve. In the notes it is stated: take the last 16 bytes ...
0
votes
1answer
171 views

Key exchange protocol and digital signatures

I am a beginner to coding and encryption standards... I have this task assigned in a course I am following: Design and implement a key exchange protocol. Include digital signatures in the protocol ...
-1
votes
1answer
55 views

ECDH vs MITM ablity to change content

We all know how DH is great, and ECDH is much greater, but only in case of Eve spying on public keys, so how can ECDH defeat the ablity of "Eve" to change the public keys between Bob and Alice with ...
3
votes
3answers
558 views

Should Diffie-Hellman on Curve25519 be validated?

I have some issues understanding the original protocol proposed by Daniel J. Bernstein for Diffie-Hellman on Curve25519. On his web page he states to not validate remote public key, but at the same ...
5
votes
2answers
1k views

Why is Diffie Hellman used alongside public keys?

I just read this post here: Why do we need asymmetric algorithms for key exchange? that asserts that in public key cryptography when asymmetric keys are used to secure communications, for parties to ...
1
vote
1answer
62 views

Naor Pinkas OT - senders security; reduction to DDH

This question concerns the security of the sender in the Naor Pinkas OT. The protocol can be found here. We can reduce the security to the DDH assumption. How exactly is this done? Can someone ...
2
votes
1answer
80 views

Diffie Hellman: Why is $(\mathbb{Z}_{8191}^*, \times)$ an insecure group?

I noticed that all the binary bits of $8191$ are $1$'s. Could this have something to do with it?
1
vote
1answer
235 views

Why does Apple use One-Pass Diffie-Hellman for file encryption?

I was reading the iOS Security Guide (snapshot) and stumbled upon the following file protection class on page 15: (NSFileProtectionCompleteUnlessOpen): Some files may need to be written while the ...
2
votes
2answers
115 views

Transmit half the bits of the $g^a$ and $g^b$ as MITM countermeasure in DH key exchange?

I remember this trick from one of my crypto courses way back then, but I can't find the details, and I'm unable to figure out the logic behind it. I'm talking about a countermeasure to the MITM ...
3
votes
3answers
193 views

Deniability properties of the X3DH Key Agreement Protocol

Signal's X3DH Key Agreement Protocol specification states in section 4.5.: Alternatively, it might be tempting to replace the DH-based mutual authentication (i.e. DH1 and DH2) with signatures from ...
0
votes
1answer
83 views

Why can't eavesdropper not make up own private key on diffie hellmann?

I try to understand diffie hellmann and I wonder why an attacker just can't make her own secret key and go along with the ride? She'd be ending up with just the same shared key. Let the private ...
1
vote
1answer
291 views

EC ECKA-ElGamal Key Agereement availability in Bouncy Castle Java library

I am trying to generate shared secret from remote EC public key(static) and client EC private key(ephemeral). In this process I am successfully able to generate shared secret using ECDH Key agreement ...
1
vote
1answer
192 views

The strength of ECDH public keys with small order

I am trying to get my head around the methods involved in ECDH and am confused by the public keys that are used. Alice picks a random number A from 1 to P - 1 and then computes A⋅g (g being the ...
1
vote
1answer
82 views

How to anonymously transfer ownership where sender cannot resend

I'm new to cyptography, so I apologize if this is a dumb/impossible goal or has already been answered (I was not able to find it by searching). I wish to devise an anonymous protocol for transferring ...
2
votes
2answers
341 views

Security of Diffie-Hellman with multiplication for secret derivation?

Today I saw this question again which presents an unusual variant of the Diffie-Hellman key exchange. Having thought about it for a while I could find out how functionally works, but have essentially ...
1
vote
1answer
349 views

Is Diffie Hellman key exchange based on one-way function or trapdoor function?

I have a question for my information security lab, which I am not able to find online. As the title says, is Diffie Hellman key exchange based on a one-way or a trapdoor function? In case of RSA I ...
4
votes
1answer
169 views

Formal Verification of DHKE protocol using ProVerif

I am new to ProVerif and trying to verify a simple DHKE protocol. The attacker is assumed as passive. The specifications are: The attacker cannot obtains the mutual key. Both participants obtain the ...
1
vote
0answers
44 views

Complexity lower bound in Uber-Assumption family

I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen (http://www.academia.edu/download/30698012/...
0
votes
1answer
84 views

Diffie-Hellman coloured abstraction

Confused with color abstraction in this video. Bob has: public color; mixture from Alice; can produce random color; Eve has: public color; mixture from Alice; can produce random color (why not?...
0
votes
1answer
273 views

ECIES: key derivation function and symmetric encryption scheme

I am using an elliptic curve library which provided me with a shared secret using my secret key and a foreign public key. Unfortunately an ECIES is not available in the programming language. I would ...
3
votes
2answers
175 views

What are the advantages of neural cryptography over Diffie-Hellman algorithm?

I am not sure whether such a question is accepted here, or if this is the correct place to ask. I have done some research on this topic, however most of the information was way too complex for me to ...
3
votes
1answer
359 views

Discrete logarithm weak group

I'm looking for weak groups in discrete logarithm, that $x$ can be extracted from $Y$ in polynomial time where $Y \equiv g^x \pmod{p}$ . I thought one way is to produce a prime $p$ that $p-1$ is an ...
3
votes
1answer
418 views

Why are digital signatures used when performing DH?

Suppose the server has a public key which everyone knows is associated with it, maybe it's hardcoded into the browser or signed by some CA. At no point do you need the server to sign anything with it,...
2
votes
2answers
134 views

Diffie-Hellman problem: is DH still secure if $g^{a^2}$ is known?

Let, $g^{a}$, $g^{b}$ are known elements, where $g\in G$ and $a, b\in Z_q$. According to Computational Diffie-Hellman (CDH) assumption, it is hard to compute $g^{ab}$. If $g^{a^2}$ is also known then ...
1
vote
1answer
105 views

co-DHP* in G2 for type 3 pairing

In type 3 pairing ($e:G_1 \times G_2\rightarrow G_\tau$ where $G_1\ne G_2$ and no isomorphism from $G_2$ to $G_1$ is known) we have co-DHP* problem: Given $H, aP \in G_1$ and $aQ\in G_2$ calculate $...
-1
votes
1answer
103 views

ECDH can be used for Key Agreement(KA) as per ECIES specification?

I want to implement a library to provide ECIES (Elliptical Curve Integrated Encryption Standard). We could see DH can be used as KA function for ECIES. I want to know specifically the ECDH (Elliptic ...
3
votes
1answer
473 views

TLS Handshake with DH

I try to understand the TLS Handshake with DH. I googled the concepts and I think I understood the basics. But there are somethings I'm still struggling with. I also read the following two posts Why ...
3
votes
1answer
222 views

Signal Double Ratchet - How can Alice send 2+ messages in the beginning of the Signal Protocol?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. Alice is initialized by Bob public ...
4
votes
2answers
205 views

Nothing Up My Sleeve Lim-Lee Primes

A few days ago I asked a question about the security of the Lim-Lee Prime Generation algorithm used by GNU Privacy Guard’s libgcrypt library. L. Carvalho provided a good answer to that question. ...
3
votes
1answer
133 views

Safety of using GPG's libgcrypt prime generation for generating ephemeral Diffie-Hellman primes?

My company wants to generate new primes for every Diffie-Hellman key exchange. We are thinking of using the prime generation scheme in GPG’s libgcrypt library. The code documentation says that the ...
-3
votes
1answer
364 views

Diffie-Hellman (Public Key exchange)

I have read a few tutorials in regards to this. My understanding is that Diffie-Hellman is a key exchange concept that is being use everywhere in our daily lives, which is also known as the public-...
3
votes
1answer
203 views

Double Ratchet Algorithm - What if the receiving wants to send the second message before the initiator?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. But in this scenario, only Alice can send ...
2
votes
0answers
87 views

Purpose of signed prekey in X3DH? [duplicate]

In the X3DH protocol a signed prekey ($SPK_B$) is used as part of the handshake. What is the purpose of this key? There seem to be no obvious cryptographic drawbacks by omitting this key. One ...
3
votes
1answer
445 views

Man-in-the-middle attack on Diffie-Hellman with shared public keys?

Is it correct to say if the public key is known to all users beforehand, Diffie-Hellman key exchange is not vulnerable to man in the middle attack? Sample key exchange ( assuming all users public ...
1
vote
1answer
167 views

DHE_RSA master secret computation?

When using DHE_RSA, the prime $p$, the generator $g$ and the public keys $A$ and $B$ are transmitted in plain text. If I know the private key of the server $a$, I can calculate $k=B^a\ mod\ p$ to ...
2
votes
1answer
267 views

why doesn't quadratic residue attack work with Elgamal encryption with decisional diffie Hellman assumption?

I was reading this notes http://www.cs.umd.edu/~jkatz/gradcrypto2/NOTES/lecture4.pdf It's given that discrete log assumption is not enough for semantic security, I'm assuming there maybe chance of ...
2
votes
0answers
333 views

Is Diffie-Hellman key exchange for multiple parties used in practice?

After reading this question about the possibility of using DH key exchange for multiple parties I went looking for a (C) library able to do this and found none. (I find it hard to believe there is no ...
1
vote
0answers
227 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
3
votes
1answer
203 views

Diffie Hellman unsafe prime vulnerability

I have done some research about how the DH key exchange is unsafe if an unsafe prime p is used (that is, $p-1$ has a lot of small factors). Many answers here on StackExchange claim that for any factor ...
2
votes
1answer
176 views

X3DH Protocol - How can the receiver calculate the Shared Key?

I'm reading about Signal Protocol and X3DH Protocol. In the X3DH Protocol, Alice sends a initial message to Bob encrypted with a Shared Key(SK). This SK is calculated using (this section): ...
1
vote
1answer
173 views

Is there any non-interactive zero knowledge proof for Diffie-Hellman tuples

I'm aware that Zero-Knowledge for Diffie-Hellman Tuples requires 4 rounds. I wondered if there is any non-interactive version of it.
-1
votes
1answer
68 views

Reversing key exchange algorithm

I'm analyzing some software and finding key exchanging procedure. Its looks like very similar with Diffie–Hellman, but not the same. I can’t understand the purpose of this. The step of algorithm is: ...
-1
votes
1answer
174 views

How do I find $g$ given $g^r \bmod p$

How can $g$ be derived from $c = g^r \bmod p$ ? $g$ and $r$ are not known, but $c$ and $p$ is. And oracle can provide many $c$ but the $r$ and $p$ is always random. I think this is somewhat related ...
3
votes
2answers
704 views

X3DH protocol - What are One-time prekeys for?

I'm reading about Signal Protocol and this protocol uses the X3DH Protocol to establish a shared secret key between the two parties but I couldn't understand why we use one-time prekeys in the flow. ...
1
vote
0answers
85 views

Why do elliptic curves require fewer bits for the same security level?

I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits. For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic ...
0
votes
1answer
258 views

What order should these HTTPS ciphers go in to maximize security?

I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
2
votes
0answers
65 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
0
votes
2answers
417 views

How should one create an ephemeral Diffie-Hellman private key?

When picking an ephemeral Diffie-Hellman private key (little a or little b), can I reasonably just pick 32 random bytes? I am specifically interested in use within SRPv6. RFC5054 says that these ...