Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

4
votes
0answers
86 views

Where do the PKs come from in Bluetooth device?

I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2. There are some questions about the PK.. Where do these public and private keys come from? Who defines them? and Will it ...
4
votes
0answers
133 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
4
votes
0answers
634 views

How does the Number Field Sieve find the target number for Diffie-Hellman?

I have read some papers relating to the Number Field Sieve, but I could not figure out how this algorithm helps in Logjam, or even what is meant by the number field. What is this? What is meant by ...
4
votes
0answers
63 views

Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
3
votes
0answers
70 views

Assuming the difference between success probabilities to be positive

Context: I am currently studying Theorem 3.1 in the paper Number-Theoretic Constructions of Efficient Pseudo-Random Functions by Naor and Reingold. The theorem basically states the randomized self-...
3
votes
0answers
65 views

Distribution of randomness in elliptic curve Diffie-Hellman shared secret

The specification for a project I'm working on says to use elliptic curve Diffie-Hellman for key exchange, specifically using the secp224r1 curve. In the notes it is stated: take the last 16 bytes ...
3
votes
0answers
238 views

Telegram VoIP key exchange

We've been trying to understand how Telegram's VoIP end-to-end encryption works. Key Exchange Detailed description of the key exchange algorithm is documented on the Telegram website. Here is the ...
3
votes
0answers
216 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
3
votes
0answers
165 views

Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...
3
votes
0answers
621 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
3
votes
0answers
366 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem to ...
2
votes
0answers
40 views

Reduction from integer factoring to computational Diffie Hellman

The computational Diffie Hellman (CDH) problem for ${\mathbb{Z}}^*_p$ is given a prime $p$, a generator $g$ of ${\mathbb{Z}}^*_p$, and a pair $(g^i, g^j)$ to compute $g^{ij}$. The value $g$ is called ...
2
votes
0answers
41 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
2
votes
0answers
60 views

How many qbits are required to break Diffie-Hellman over a multiplicative group

There have been comparisons between RSA and ECDH with regards to the number of qbits (qubits) required to break the algorithm with a specific key size. But how many qbits are required to break "...
2
votes
0answers
294 views

What ECDSA key is used to sign the ECDHE key exchange?

I have a server using TLS1.2 with an ECDSA certificate using secp256r1. The algorithms being used to connect to my browser are TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as I expect from my server ...
2
votes
0answers
57 views

Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria? ...
2
votes
0answers
333 views

Is Diffie-Hellman key exchange for multiple parties used in practice?

After reading this question about the possibility of using DH key exchange for multiple parties I went looking for a (C) library able to do this and found none. (I find it hard to believe there is no ...
2
votes
0answers
65 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
2
votes
0answers
413 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
2
votes
0answers
311 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
0answers
145 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
2
votes
0answers
284 views

Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
1
vote
0answers
40 views

Diffie hellman: fixed modulus a risk?

In DH, are algorithms with fixed modulus p (large safe prime) to be avoided? What if it was changed every x minutes?
1
vote
0answers
39 views

Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?

I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
1
vote
0answers
77 views

Multi-Party Offline Key Exchange Using Public and Private Keys

I hope the title already explains the problem I have in mind; but let me lay out some more details. Given public-private key pairs $P_A, P_B, P_C, ... P_Z$, (first $3$ of which are owned by our usual ...
1
vote
0answers
67 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
1
vote
0answers
139 views

ECC Curve25519: How to generate this kind of private key? / Strange key exchange mechanism

I'm currently reverse engineering a program that uses Curve25519 key exchange in network communication. I have only a basic understanding of ECC, so maybe this thing just seems strange to me. The ...
1
vote
0answers
32 views

GPG encrypt performance degradence for thousands receipients

I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands). I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist ...
1
vote
0answers
44 views

Complexity lower bound in Uber-Assumption family

I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen (http://www.academia.edu/download/30698012/...
1
vote
0answers
227 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
1
vote
0answers
85 views

Why do elliptic curves require fewer bits for the same security level?

I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits. For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic ...
1
vote
0answers
153 views

Key exchange during IKE_AUTH phase of IKEv2

This is what a casual IKEv2 handshake looks like : ...
1
vote
0answers
93 views

Algorithms to securely derive symmetric keys

I need to derive symmetric keys between two communication endpoints on an embedded device with 800MHz ARM core. What algorithms are available to have this secure key derivation mechanism? I know ...
1
vote
0answers
756 views

Is ECDH(E) Key Exchange FIPS 140-2 compliant?

We have read dozens of documents now - some that contradict each other - and cannot find a solid source of truth. Does FIPS 140-2 compliance allow for the use of elliptic curve cryptography as a key ...
1
vote
0answers
222 views

CDH <=> and Square-DH. Square root problem

Here describes a way of proving CDH <=> and Square-DH. The thing I don't get - how to efficiently compute $CDH(U,V)$ from $CDH(U,V)^2$. Isn't Square root problem is hard in general? (In case of ...
1
vote
0answers
652 views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
1
vote
0answers
154 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
1
vote
0answers
224 views

Solving discrete logarithm when p is not a safe prime

If you have the cyclic group of integers modulo $p$, where $p$ is not a safe prime, as well as a generator $g$ with which for all factors $q$ of $(p-1)$, $g^{(p-1)/q} \ne 1$, This answer says that ...
1
vote
0answers
207 views

My attempt of combining socialist millionaire and Diffie-Hellman. Is it any good?

I've come up with an algorithm to solve the socialist millionaire problem, but I'm not sure if the algorithm is secure. I wasn't able to find any flaw in it, but it seems too simple to be secure, so I'...
1
vote
0answers
213 views

Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
1
vote
0answers
128 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
1
vote
0answers
334 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
0
votes
0answers
42 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
0
votes
0answers
41 views

Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
0
votes
0answers
41 views

What protocols are secure under computational and decisional diffie hellman assumption respectively?

I am new to crypto, and I have read the definitions of Computational Diffie-Hellman(CDH) and Decisional Diffie-Hellman(DDH) assumption, though I tried to figure out the differences between the two ...
0
votes
0answers
29 views

Questions regarding the concept of encrypting a device's USB communication

I'm trying to understand the following two images. They describe the Initialization and authentication process of an embedded device that supports encrypted USB communication. In the first image the ...
0
votes
0answers
147 views

Is it possible to prove identity using Diffie-Hellman?

I was wondering if it was possible to sign using Diffie-Hellman. I thought about it many times and i think it should be possible to sign using a public key the user trusts. So it would look like this: ...
0
votes
0answers
180 views

Parameters and key dimension for DH and RSA

I studied RSA and Diffie-Hellman key exchange from a quite old book (Discrete Mathematics by Berardi, Beutelspacher) and so I wonder if the recommended dimensions for the prime p and the secret ...
0
votes
0answers
67 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
0
votes
0answers
141 views

Property of Multiplicative group of integers mod n

While practising on paper I've realized of a property of multiplicative group of integers mod $n$. First, let's define $G$ being $p$ a prime and $g$ a primitive root mod n or a generator of a ...