Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
57 votes
2 answers
37k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
user3160055's user avatar
47 votes
4 answers
39k views

Can one generalize the Diffie-Hellman key exchange to three or more parties?

Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties? I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
hobeau's user avatar
  • 823
44 votes
2 answers
43k views

What's the fundamental difference between Diffie-Hellman and RSA?

What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
user541686's user avatar
  • 1,349
38 votes
2 answers
80k views

What's the difference between RSA and Diffie-Hellman? [duplicate]

I've been reading the same thing on a lot of websites: RSA is for communication using the public and private key for both the server and client, whereas Diffie-Hellman is just for exchanging the same ...
user3407319's user avatar
35 votes
7 answers
13k views

Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ...
user avatar
34 votes
1 answer
7k views

Does the generator size matter in Diffie-Hellman?

For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
jnm2's user avatar
  • 582
33 votes
3 answers
15k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
mikeazo's user avatar
  • 38.6k
32 votes
1 answer
9k views

What is a ratchet?

while reading Whatsapp's Security Whitepaper I found the term "ratchet". What does it mean in cryptography? The Message Key is derived from a sender’s Chain Key that “ratchets” forward with every ...
M-elman's user avatar
  • 1,248
31 votes
2 answers
6k views

How does a non-prime modulus for Diffie-Hellman allow for a backdoor?

Recently someone found that a Diffie-Hellman modulus used in a unix tool (socat) was not prime. This led some people to shout "backdoor". What I don't understand ...
David 天宇 Wong's user avatar
28 votes
3 answers
39k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
Clay Freeman's user avatar
28 votes
2 answers
26k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
Mr_and_Mrs_D's user avatar
27 votes
2 answers
8k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
CodesInChaos's user avatar
  • 24.9k
26 votes
1 answer
13k views

How does ECDH arrive on a shared secret?

I read a brilliant, three part article on Elliptic Curve cryptography (one, two, three). It was able to explain Elliptic Curves to me in a way that didn't require a math degree to understand. The ...
Eddie's user avatar
  • 983
23 votes
4 answers
14k views

What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?

How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related? From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
Bobby S's user avatar
  • 1,953
21 votes
3 answers
23k views

How does one calculate a primitive root for Diffie-Hellman?

In the Diffie-Hellman key exchange, one of the steps involves calculating a primitive root of a prime number $p$. How would one go about doing so, considering that $p$ could be very large? Is there ...
yydl's user avatar
  • 699
21 votes
2 answers
23k views

How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?

I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves. Here is how DH works: Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one ...
user28432's user avatar
  • 211
19 votes
1 answer
8k views

Why do we need Diffie Hellman?

Diffie–Hellman offers secure key exchange only if sides are authenticated. For authentication, sides are using public/private key. So if side A knows the public key of the side B, then A can simply ...
piotrek's user avatar
  • 293
18 votes
1 answer
5k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
knaccc's user avatar
  • 4,732
18 votes
1 answer
2k views

Perfect Forward Secrecy with NaCl

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application. From what I understand, all Bob needs to to decrypt a ...
dubadu's user avatar
  • 303
18 votes
1 answer
4k views

How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
marlenn's user avatar
  • 181
17 votes
2 answers
17k views

What is the key size currently used by RSA and Diffie-Hellman for secure communication over Internet?

What is the key size that RSA and Diffie-Hellman are using now that can guarantee secure communication over Internet and will not be able to break by the best available algorithms (NFS & FFS or ...
Tanmay Sharma's user avatar
17 votes
1 answer
19k views

Advantages using Diffie-Hellman or ElGamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other? I do not see a clear difference ...
Hastal's user avatar
  • 171
17 votes
1 answer
4k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
TomW's user avatar
  • 171
17 votes
1 answer
4k views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a co-...
Kiran's user avatar
  • 301
17 votes
2 answers
13k views

Is perfect-forward secrecy achieved with RSA?

I am new to cryptography and am going through the book Understanding Cryptography by Paar and Pelzl. From what I understand Symmetric key distribution systems like Kerberos do not provide PFS ...
Ben Lamm's user avatar
  • 273
16 votes
2 answers
3k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
Elias Zamaria's user avatar
16 votes
4 answers
9k views

Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?

I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was ...
Nadim Kobeissi's user avatar
16 votes
2 answers
2k views

Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; $g^{...
Myath's user avatar
  • 845
15 votes
1 answer
685 views

Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
SEJPM's user avatar
  • 46.1k
14 votes
0 answers
923 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
kelalaka's user avatar
  • 48.7k
13 votes
2 answers
919 views

What motivated the creation of RSA and ECDH?

Recently I've been learning about cryptography and so far I am loving it. However, there are some things I do not comprehend. As far as I know, RSA was published in 1979 while New Directions on ...
a-lawliet's user avatar
  • 151
13 votes
3 answers
11k views

What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least 256-...
Jim's user avatar
  • 133
13 votes
1 answer
12k views

Explanation of the Decision Diffie Hellman (DDH) problem.

I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
Nico Bellic's user avatar
13 votes
2 answers
4k views

Why do public keys need to be validated?

For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
CodesInChaos's user avatar
  • 24.9k
13 votes
1 answer
5k views

Diffie-Hellman Parameter Check: when g = 2, must p ≡ 11 (mod 24)?

I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). When I test some of the group ...
user avatar
13 votes
2 answers
20k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
Ali Gajani's user avatar
13 votes
2 answers
2k views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
Edward Ned Harvey's user avatar
13 votes
3 answers
7k views

What does "export grade" cryptography mean? And how is this related to the Logjam attack?

I am doing some research on the Logjam attack, and I need help in learning some terms that are new for me. What does "export grade" cryptography mean? And how is this related to the Logjam attack?
han's user avatar
  • 419
12 votes
1 answer
10k views

What Diffie-Hellman parameters should I use?

After reading this article, I started wondering how should I approach the problem of choosing p and g params in 1024-bit Diffie-Hellman key exchange. In my project, I am going to establish keys ...
michnovka's user avatar
  • 356
12 votes
1 answer
8k views

Diffie-Hellman: choosing wrong generator "g" parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime $p$ and base $g$, which is primitive root $\bmod p$. Suppose that the generation algorithm is broken and $g$ generates only a ...
Pat Kug's user avatar
  • 123
12 votes
2 answers
2k views

Are CDH and Square-DH equally hard?

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $\operatorname{CDH}(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ ...
T.B's user avatar
  • 1,292
11 votes
4 answers
1k views

RSA & DH at risk due to math advances, will this eventually affect elliptic curves too?

I was looking into the predictions by some researchers that RSA and Diffie-Hellman may not be secure in the next few years due to advances in math and being able to calculate the discrete logarithm ...
Jesse's user avatar
  • 415
11 votes
2 answers
15k views

How large should a Diffie-Hellman p be?

In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
Inaimathi's user avatar
  • 1,587
11 votes
1 answer
2k views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
Maarten Bodewes's user avatar
  • 92.9k
11 votes
4 answers
2k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST states ...
NotACryptographer's user avatar
11 votes
1 answer
3k views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://datatracker.ietf.org/doc/html/draft-ietf-tls-tls13-28
Nathan Aw's user avatar
  • 2,277
11 votes
2 answers
7k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
sce's user avatar
  • 267
11 votes
1 answer
2k views

ECIES vs. RSA + AES

I am confused about the distinction between RSA and ECC (Elliptic curve) regarding encryption and would appreciate it if someone could confirm whether my understanding is correct. To encrypt a large ...
Vlad's user avatar
  • 569
11 votes
1 answer
914 views

Should I use self generated or predefined RFC 7919 DH groups?

On a wiki page, archived by now, Mozilla switched from recommending self generated DH groups to the ones predefinded in RFC 7919. The recommendation was accompanied by the statement These groups are ...
wedi's user avatar
  • 211
11 votes
1 answer
2k views

curve25519 weak points for contributory behaviour

The Diffie-Hellman on curve25519 is usually calculated using the base point $(9,…)$ which induces a cyclic subgroup of $G:=\{\infty\}\cup(E(F_{p^2})\cap(F_p\times F_p))$ with index 8, i.e. there is a ...
Perseids's user avatar
  • 562

1
2 3 4 5
22