Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
0 votes
1 answer
107 views

Key generation for DH key exchange - benefits of using KMI

Context We need to generate a key pair in order to perform DH key exchange with the other party. Some suggest to use a KMI solution (think: AWS KMS or like) in order to generate the key pair. ...
2 votes
1 answer
75 views

Commutable and Composable Asymmetric Encryption/Decryption

I have a need for the following encryption properties: $f(g(v_\text{plaintext}) = v_\text{ciphertext}$ needs to be decryptable by $f^{-1}(g^{-1}(v_\text{ciphertext}))$ and $f$ and $g$ need to be ...
2 votes
1 answer
72 views

How does this libgcrypt elgamal decryption work?

Update: The question below was asked before I realized that this is being done to prevent a side channel attack: https://github.com/advisories/GHSA-5p8v-2xvp-pwmc What I am still curious about, is the ...
3 votes
1 answer
224 views

How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
2 votes
1 answer
678 views

Zero Knowledge Proof AND Diffie-Hellman?

From my research, I think that everyone says that the result of a zero-knowledge proof (ZKP) is that the participants end up with a shared secret that can be used as a session key for a further ...
1 vote
2 answers
250 views

How is Diffie-Hellman secure when the exchanged number is a power of the generator less than the modulo

I'm trying to understand how Diffie-Hellman is still secure when $A$ ends up being a power of $g$ less than $p$. I chose $p$, where p is prime, and $g$ is a primitive root modulo $p$. $g=2$ and $p=29$ ...
2 votes
1 answer
179 views

Diffie-Hellman exchange result is always 1

I watched a video on Khan Academy explaining the Diffie-Hellman key exchange. When I try to do an example problem, I get 1 all the time. Does the generator and prime modulus (or base on Wikipedia) ...
0 votes
3 answers
104 views

mutual authentication in STS protocol

STS Protocol is like this: $A \rightarrow B:~ g^x$ $A \leftarrow B:~ g^y, E_K(S_B(g^y, g^x))$ $A \rightarrow B:~ E_K(S_A(g^x, g^y))$ My question is why do we say in STS we have mutual authentication?...
0 votes
1 answer
114 views

Authentication Fold-In in Oracle Database

The Oracle database has a feature known as "Native Network Encryption". It is a protocol described as a 4-step procedure. Step 1 : Negotiate parameters for following steps Step 2 : Exchange ...
0 votes
2 answers
177 views

In a Diffie-Hellman key exchange Find this key and compute the shared secret key k

Hi I struggling to find the answer of my schhol exam, can anyone help me . In a Diffie-Hellman key exchange the multiplicative group of integers modulo p is used with the parameters p = 59, g = 3 mod ...
0 votes
1 answer
37 views

How is the shared secret generated in IPsec using DH key generation?

I have doubt like when in the IPsec we use a DH group for key exchange. It takes a prime number and $g$ value from group bit. How does the key exchange payload and nonce help to generate the shared ...
0 votes
1 answer
34 views

Trying out the small subgroup attack on a group of non-prime order using a simple additive group instead of an Elliptic Curve Group?

This is the attack I am talking about - Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? An elliptic curve group of order $8p$ where $p$ is a prime. Let $G$ be the ...
3 votes
1 answer
225 views

Understanding the small cofactor attack with Elliptic Curves of non-prime order

I came across 2 older answers (2 different but similar questions on the small cofactor attack) which cover this attack. https://crypto.stackexchange.com/a/12614/3941 Here the attacker replaces the $...
2 votes
1 answer
175 views

Signal protocol: X3DH

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, <...
1 vote
1 answer
380 views

Diffie-Hellman over $GF(2^{128})$

Can I use Diffie-Hellman over, say, $GF(2^{128}) \bmod$ irreducible poly in $GF(2^{128})$ instead of $GF(p)$? If not, why? Or increase it to $GF(2^{2^{\text{whatever}}})$.
7 votes
1 answer
2k views

What's the difference beteween SIDH and SIKE?

I'm a semi newbie in crypto (I've had that uni course of discrete math that includes basic cryptography principles) and wanted to go a bit further in isogeny graphs. I have downloaded the C ...
2 votes
1 answer
395 views

Why is this authenticated Diffie–Hellman key exchange insecure?

I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember $$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$ $$B\to A: (B, g^...
0 votes
1 answer
104 views

How is Diffie-Hellman linked to AES?

I have just learnt about Diffie-Hellman and AES. However, I cannot seem to understand how they link. My initial idea was that Diffie-hellman is used to transfer a key for AES decryption. After further ...
2 votes
2 answers
166 views

ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
2 votes
1 answer
172 views

Where is the definition of one-way trap-door function used in public key cryptography

This is a rather simple question but I've been unable to find a proper answer for this online. When defining an asymmetric (public key) algorithm is the one-way trap-door function usage referring to ...
2 votes
2 answers
66 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
0 votes
0 answers
17 views

Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
0 votes
1 answer
27 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8 in ACVP

Hi I found this question which I am currently struggling with. How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8? In ACVP, the input diffe-hellman shared secret ...
7 votes
1 answer
2k views

Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

Does perfect forwarding secrecy, as used for e.g. the DHE_ and ECDHE_ TLS ciphersuites make it impossible for quantum analysis ...
0 votes
0 answers
57 views

What is the best choice of the base g in El-Gamal PKC

I have just read in a book that in El-Gamal PKC, the best choice of a base g is a number whose order in the field ($\mathbb{F}_p$) is a large prime, and added: "approximately = $\frac{p}{2}$"...
8 votes
3 answers
2k views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
8 votes
1 answer
5k views

Small subgroup confinement attack on Diffie-Hellman

I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ...
0 votes
1 answer
68 views

How SSL (similar version) works?

My book suggested the following protocol to replace SSL: A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
2 votes
1 answer
162 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
-1 votes
1 answer
39 views

The benefit of the shared key generated from ECDH key exchange protocol [duplicate]

What the benefit of the shared key that generated from ECDH key exchange protocol? Can I use it to encrypt the message or encrypt the public key of asymmetric encryption?
2 votes
1 answer
85 views

Could anyone explain what Two Oracle Diffie-Hellman assumption is?

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already ...
0 votes
0 answers
24 views

The appropriate smoothness bound

My question roots from another question asked in the community since I do not have enough reputation points to comment on the answer, I was hoping I could ask it here. How was the individual asking ...
0 votes
1 answer
114 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
0 votes
0 answers
51 views

How to reduce Diffie Hellman problem to ElGamal?

I'm trying to answer without success questions (ii - iv) Any hint will be appreciated :)
0 votes
0 answers
21 views

Looking for multi-party key exchange/shared secret algorithm with specific requirements

I'm looking for the ability to create a SINGLE CONSTANT shared secret amongst two or more users (a group) AND if a new user is added to such a secured group the new user should also be able to learn ...
0 votes
2 answers
69 views

What E means in Diffie Hellman protocol?

I was looking for an example of protocol to verify user's identity using Diffie Hellman which works like this: client sends: $g^x$, ...
1 vote
1 answer
477 views

Why discrete logarithm modulo composite moduli not popular and not defined in standards?

The classical discrete logarithm problem is to find $x$ such that $g^x\equiv h\bmod p$ where $p$ is a prime and $g$ is generator of multiplicative group modulo $p$. The demerit of this approach seems ...
3 votes
3 answers
574 views

What is the need for Diffie-Hellman key exchange when we have asymmetric encryption?

I am new to cryptography and I am having a hard time understanding what is the need for DHKE procedure. I think I fully understand the principle in which it happens and also the mathematics behind it ...
3 votes
2 answers
850 views

Multiparty key exchange for end-to-end encryption

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
2 votes
3 answers
643 views

Which is better when the secret is leaked, RSA or Diffie-Hellman?

I know that DH can be used for perfect forward secrecy but for the sake of this example, let's say that RSA and Diffie-Hellman are both used to establish a symmetric key that will be used for future ...
2 votes
1 answer
970 views

The compression of the elliptic curve point coordinates

Some time ago I faced the problem of the unexpected format compression of the points on elliptic curve. I used ECDH procedure with a third party service on the base of the $\mathbb({F}_{2^m})$ curve ...
0 votes
2 answers
132 views

Why do we need to use Asymmetric cryptography if Diffie-Hellman solves the key exchange problem of symmetric cryptography?

I am new to cryptography and I cant get my head around this issue: If symmetric cryptography is faster then asymmetric and given that Diffie-Hellman key exchange algorithm allows you to exchange keys ...
3 votes
1 answer
1k views

Composition of X25519+XSalsa20+Poly1305

In a correct implementation of X25519+XSalsa20+Poly1305, I think I have the right understanding in saying that the Poly1305 message authentication code is a ...
1 vote
0 answers
56 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
1 vote
1 answer
112 views

Sending encrypted message without public key from recipient (elgamal)

assume Bob and Alice use Elgamal encryption scheme. Alice wants to send Bob a message, but does not know Bobs public key. Is there a way for Alice to find out Bobs public key by receiving multiple ...
1 vote
2 answers
123 views

Can a MITM during Diffie-Hellman key exchange manipulate both sides to generate symmetric secrets?

Is it possible for an attacker on a Diffie-Hellman key exchange to manipulate both sides in a way so that the secret generated on each side is identical? Or put differently, would it be possible to ...
3 votes
2 answers
2k views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
0 votes
1 answer
73 views

What's the meaning of asterisk and PPT in this paper?

I'm very new to cryptography. I'm required to read a paper. I totally don't understand. First, what's the meaning of the asterisk in $H:\{0,1\}^*\rightarrow \{0,1\}^k ?$. Second, what does PPT mean ...
7 votes
2 answers
218 views

Is there a complete summarized list of attacks on Diffie-Hellman?

Is there a complete summarized list of attacks on Diffie-Hellman? For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
2 votes
1 answer
64 views

Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

Let's suppose that Bob has only Alice's IP and no more information about Alice's key, nor the digest of Alice's key. They exchange keys and need proof that the received keys are the same keys that ...

1
2 3 4 5
20