Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

0
votes
2answers
231 views

Why is Decisional Diffie–Hellman assumption harder than the Computational Diffie–Hellman assumption in cryptography?

I did not understand why the decisional Diffie-Hellman assumption is harder than computational Diffie-Hellman assumption, I read that there are groups where DDH is known to be easy but CDH is still ...
2
votes
1answer
714 views

Finding the private key in Diffie Hellman

Lets say there are 2 parties X and Y. They have agreed on prime number P and generator g. X uses the secret key K. After the key exchange they calculated the common secret key g^4. What are the 2 ...
4
votes
1answer
142 views

Is there a problem using Diffie-Hellman over a Mersenne prime?

Reductions modulo Mersenne primes are extremely fast, and there are several of a suitable size for modp-based Diffie-Hellman (such as $2^{2281}-1$). Is there any reason such primes are not commonly ...
3
votes
1answer
132 views

Why work in a subgroup for Naor and Pinkas oblivious transfer?

In section 4 (protocol 4.1) of the paper by Naor and Pinkas [1], why did the authors decide to operate in a subgroup? When they say "the messages are in the subgroup" does that mean $x, y, z_0, z_1$, $...
0
votes
2answers
722 views

Is it possible to reverse Diffie-Hellman key exchange?

Is it possible to reverse Diffie-Hellman key exchange to get the private key of one of the parties, given a large prime number 'p' .
1
vote
1answer
291 views

how to choose a random secret key for ECDH

I am a beginner, I can understand the basics of ECC and elliptic curve, i can't find where I missed to understand. But I have a great doubt in ECDH regarding below. Could any of you please clarify for ...
1
vote
1answer
87 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...
7
votes
1answer
573 views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
2
votes
1answer
346 views

Is the openssl implementation of ECDH missing something?

From the OpenSSL Wiki: Also note that the derived shared secret is not suitable for use directly as a shared key. Typically the shared secret is passed through some hash function first in order to ...
1
vote
1answer
384 views

Diffie-Hellmann generator

As far as I understand, there isn't an easy algorithm to find the generator of a cyclic group used in DH Key exchange. Is it true? Given a large prime number like, e.g. 0x614423aaf0d10001f7d7, how can ...
-1
votes
1answer
356 views

Diffie-Hellman key exchange, choosing the secret key [duplicate]

I very well understand the Diffie-Hellman key exchange method, at least I think I do. And I was trying to implement it to try it out. I went and calculated a very large prime number $p$ about 400 ...
2
votes
2answers
455 views

Diffie-Hellman key exchange - why is modulo operation necessary?

Could someone explain why it's necessary to have the modulo operation in the Diffie-Hellman key exchange? Let's imagine we do DH without the modulo operation ($A = g^a, B = g^b$). Would that not work,...
2
votes
2answers
616 views

Diffie Hellman Problem (DHP) and Discrete Logarithmic Problem (DLP)

I am novice here. I am following a lecture series of Prof. Christof Paar and in his lecture of DLP, he states a fact which I did not understand at all. Can somebody please explain it better to me.I ...
3
votes
1answer
250 views

Does the prime modulus have to be bigger that the generator?

In the DH algorithm $ a^x \bmod b $ where $ a $ is the generator and $b $ is the prime modulus does $b $ have to be bigger than $ a $ or could $ a $ be larger for example $ 19^x \bmod 17 $ . Because I ...
1
vote
1answer
289 views

How to correctly evaluate the security of DH in TLS

I'm trying to understand and evaluate the security impact of DH in TLS. As far as I can tell, there are four major different implementations of DH in TLS. DH DHE ECDH ECDHE With the ephemeral DH's, ...
2
votes
2answers
594 views

Summarize the mathematical problem at the heart of breaking a Curve25519 public key

It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do: e[0] &= 248 e[31] &= 127 e[31] |= 64 You can then ...
2
votes
1answer
206 views

Use of shared secret “other” than key creation

I have read and (believe) I understand the basics of key exchange / creation over a public channel of communication from this diagram Diffie–Hellman key exchange. Now, a fair bit of the online ...
1
vote
2answers
182 views

Sliding windows implementation (Exponentiation by squaring)

I am conducting a research on cpu-cache based info leak caused by using Sliding window in the diffie helman key exchange. For my research I am looking for a real-world implementation of sliding ...
1
vote
0answers
153 views

Key exchange during IKE_AUTH phase of IKEv2

This is what a casual IKEv2 handshake looks like : ...
4
votes
1answer
169 views

Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$ $|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \...
2
votes
1answer
464 views

Can ECDH be used for authentication?

Is it safe to use ECDH for challenge-response authentication, with server key being ephemeral? The goal is that server does not store sensitive data (hashes) and allow clients to use additional ...
5
votes
1answer
123 views

What are the problems with Diffie-Hellman groups 3 and 4 (RFC 2409 + RFC 2412)?

In RFC 2409 and RFC 2412 Diffie-Hellman groups 3 and 4 were defined. These are groups over elliptic curves based on Galois Fields with and elements respectively. I know that these sizes are ...
1
vote
1answer
125 views

Sum probability

if $a,b,c$ are selected at random from a large cyclic group, then what could be the probability that $g^{a+b}$=$g^c$? it simply corresponds to the probability that multiplication of two random ...
2
votes
1answer
332 views

Why can ECDSA public keys be sent over an insecure network, while ECDSA is used to sign ECDH public keys to securely be transported over the network?

Basically the title says it all. I am trying to develop and understand an ECDH-ECDSA encryption. My current approach to provide some form of authentication to the ECDH is to use ECDSA to sign the ...
0
votes
2answers
341 views

diffie hellman digital signatures vs MACs [duplicate]

I have the following homework question that im not sure about. Alice and bob are going to use the diffie-hellman key agreement protocol to agree on a key for use in AES. Explain briefly why they ...
4
votes
1answer
290 views

XOR instead of Multiplication in ElGamal encryption

In the ElGamal encryption scheme, the message $m$ is multiplied with the secret $g^{xy}$ Wikipedia. I don't understand the advantage of it. Why we can't just XOR our message with the shared secret? As ...
2
votes
1answer
177 views

Security of Diffie-Hellman when one party has a flawed RNG (compared to TOFU)

Use case: We need to establish a long-lived key. In this phase, it is unlikely attacker will either sniff or the modify communication, but we want to cover even this case. So we use Diffie-Hellman or ...
1
vote
1answer
622 views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
2
votes
1answer
160 views

How Mutual authentication and Forward secrecy in The X3DH Key Agreement Protocol work?

Can someone explain the statement below from section 3.3 in The X3DH Key Agreement Protocol? DH1 = DH(IKA, SPKB) DH2 = DH(EKA, IKB) DH3 = DH(EKA, SPKB) DH4 = DH(EKA, OPKB) SK = ...
1
vote
0answers
93 views

Algorithms to securely derive symmetric keys

I need to derive symmetric keys between two communication endpoints on an embedded device with 800MHz ARM core. What algorithms are available to have this secure key derivation mechanism? I know ...
0
votes
1answer
295 views

Deniability and Prekey Security in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from The X3DH Key Agreement Protocol? 1st paragraph: What is deniability and how does it work here? Deniability X3DH doesn't give either Alice ...
0
votes
1answer
189 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
0
votes
0answers
147 views

Is it possible to prove identity using Diffie-Hellman?

I was wondering if it was possible to sign using Diffie-Hellman. I thought about it many times and i think it should be possible to sign using a public key the user trusts. So it would look like this: ...
3
votes
1answer
493 views

TLS: Does Diffie-Hellman make private keys useless

When we are using TLS these days we use DH to establish a session key. So where in the TLS protocol do we determine that the host that we're talking to actually possesses the private key corresponding ...
4
votes
1answer
278 views

What is a u-coordinate within Elliptic Curve Diffie-Hellman using the Montgomery ladder

I am trying to understand the below paragraph. Elliptic curve Diffie-Hellman is often calculated using the Montgomery ladder. This gives a simple and efficient calculation that is naturally ...
14
votes
2answers
5k views

What is the key size currently used by RSA and Diffie-Hellman for secure communication over Internet?

What is the key size that RSA and Diffie-Hellman are using now that can guarantee secure communication over Internet and will not be able to break by the best available algorithms (NFS & FFS or ...
2
votes
1answer
346 views

Zero Knowledge Proof AND Diffie Helmann?

From my research, I think what everything says is that the result of a zero knowledge proof (ZKP) is that the participants end up with a shared secret that can be used as a session key for a further ...
1
vote
1answer
420 views

Diffie-Hellman: Should the subgroup have prime order?

Hi I previously asked a question about Diffie-Hellman parameters but wanted to make sure I got it right. I need to generate parameters for the SRP protocol. My base strategy is to generate a safe ...
0
votes
1answer
183 views

Can TweetNaCl box sender's private key be set to “1” without privacy loss?

The use case is: I need to encrypt data such that only my own private key can be used to decrypt it, from a machine that only knows my public key. I'd prefer not to have to create and keep track of a ...
1
vote
1answer
362 views

MITM defense in Diffie-Hellman protocol

Let's consider that Alice and Bob both know a shared secret $secret$ and don't know each other DH public keys. They want to authenticate each other and their keys using only $secret$. Let's also ...
3
votes
1answer
271 views

On getting beyond LSB in discrete log

In discrete log we employ sophie germain primes $p=2q+1$ where $q$ is a prime. Then we know least significant bit $x_0$ in $$g^{2x+x_0}=h\bmod p$$ where $2x+x_0$ is discrete logarithm of known $h\...
3
votes
0answers
238 views

Telegram VoIP key exchange

We've been trying to understand how Telegram's VoIP end-to-end encryption works. Key Exchange Detailed description of the key exchange algorithm is documented on the Telegram website. Here is the ...
0
votes
2answers
131 views

Sylow theorems in (Z/pZ)*

This might sound as a silly question but does the Sylow theorem III apply to (Z/pZ)*? For Example for (Z/11Z)* we have the order of the group being 10 = 2 * 5. I would expect to have only 1 Sylow 5-...
0
votes
1answer
177 views

Determining the primitive root $g$ of $p$, given $B=g^b \pmod p$

This is related to Diffie-Hellman key exchange. Suppose you're given a prime $p, b \in \{0,1,...,p-2\}$, and $B$, such that $$ B= g^b \pmod p. $$ Assuming that $$\gcd(b, p-1)=1$$ How could you ...
0
votes
2answers
85 views

Can someone explain the definition of four square roots as it pertains to groups in Z*p?

So I'm given the following as a problem: When $p$ and $q$ are distinct odd primes and $N = pq$, the points in $Z^∗_N$ have either zero or four square roots. A quarter of the points have four square ...
6
votes
1answer
183 views

Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly. The ...
1
vote
1answer
1k views

Establish a secure connection between a Bluetooth Low Energy device and an Android App using ECDH

Im very new to security and trying to learn how to establish a secure connection between a android application and a Bluetooth Low Energy device with limited hardware performance. The procedure: App:...
2
votes
1answer
145 views

What are the consequences (and potential mitigation) to poor entropy/RNG on server-side during ephemermal key generation and DH exchange

I am using a hardware TRNG feeding the entropy pool on the client side. But, in a world of virtualized, headless server hosts, what are the cryptographic/security consequences for random numbers (or a ...
1
vote
1answer
378 views

ElGamal cipher decryption (reposted not from guest account)

My sincerest apologies for having to repost this but I can't edit or post a comment from the previous one I asked with a guest account. I'm learning about the Diffie-Hellman and ElGamal ciphers, but ...
2
votes
1answer
436 views

What kind of symmetric-key algorithm to use with Diffie-Hellman?

Let's assume we use DH with a cyclic group modulo p. As I know safe length of p must be at least 1024 bits. That means that ...