# Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

164 questions
Filter by
Sorted by
Tagged with
945 views

### Discrete Logarithm: Given a p, what does it mean to find the discrete logarithm of x to base y?

My understanding is that $a^b \bmod p$ is the discrete logarithm problem. Given the question is worded this way, are we trying to find $\log_y x \bmod p$. For instance, if we are trying to compute ...
701 views

### Curve25519 Key Validation

According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from? Is there any proof ...
• 277
2k views

### Summarize the mathematical problem at the heart of breaking a Curve25519 public key

It's pretty easy to generate a Curve25519 private key: generate 32 random bytes of data and then do: e &= 248 e &= 127 e |= 64 You can then ...
• 207
7k views

### Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
• 24.3k
4k views

### After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
• 3,902
12k views

### What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?

How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related? From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
• 1,903
33k views

### Can one generalize the Diffie-Hellman key exchange to three or more parties?

Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties? I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
• 793
14k views

### For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
• 37.9k
629 views

### How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
366 views

### Is it possible to generate backdoored DH parameters?

I know it has been already asked and answered whether it's possible to generate weak DH parameters. But "recentely" we experienced the Logjam attack, which makes use of the pre-computation ...
• 44.8k
2k views

### Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://datatracker.ietf.org/doc/html/draft-ietf-tls-tls13-28
• 2,129
12k views

### How to find generator $g$ in a cyclic group?

As generator $g$ is used in DH how do you find a combination of prime $p$ and $g$? eg: if we choose $p=23$ and its generator is $7$ (given in the book) how do we find the generator?
• 81
2k views

### Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST states ...
10k views

### What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least 256-...
• 133
2k views

### How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
• 86.5k
8k views

### Static DH/Static ECDH certificate using OpenSSL

I've been searching for some time and have found no way to create a working certificate and private key pair with a DH or ECDH public key using OpenSSL. Once I do this, I'd like to sign it with an RSA ...
• 51
12k views

### Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ... 21k views

### How does one calculate a primitive root for Diffie-Hellman?

In the Diffie-Hellman key exchange, one of the steps involves calculating a primitive root of a prime number $p$. How would one go about doing so, considering that $p$ could be very large? Is there ...
• 679
8k views

### What is a ratchet?

while reading Whatsapp's Security Whitepaper I found the term "ratchet". What does it mean in cryptography? The Message Key is derived from a sender’s Chain Key that “ratchets” forward with every ...
• 1,168
621 views

### Logjam on Elliptic Curves?

I think we're all aware of the Logjam attack. From now on we know that re-using primes for DH is a bad idea. But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
• 44.8k
2k views

### Are CDH and Square-DH equally hard?

CDH problem roughly says that choose $U=g^u, V=g^v$ uniformly at random from cyclic group $G$, it's hard to compute $\operatorname{CDH}(U,V)=g^{uv}$. Square-DH problem roughly says choose $U=g^u$ ...
• 1,252
533 views

### The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
• 44.2k
7k views

### Why is a Diffie-Hellman key exchange required when RSA is already being used for key exchange in TLS?

Specifically with TLS, What is RSA used for during key exchange? What is Diffie-Hellman used for? Since RSA already provides authenticity and confidentiality, why is Diffie-Hellman used during the ...
• 203
5k views

### How does a non-prime modulus for Diffie-Hellman allow for a backdoor?

Recently someone found that a Diffie-Hellman modulus used in a unix tool (socat) was not prime. This led some people to shout "backdoor". What I don't understand ...
• 1,495
18k views

### Advantages using Diffie-Hellman or ElGamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other? I do not see a clear difference ...
• 161
3k views

### Why do public keys need to be validated?

For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
• 24.3k
1k views

### Finding roots in $\mathbb{Z}_p$

Is there an efficient way (algorihtm) to compute the solutions of the congruence $x^n\equiv a \pmod p$? $n\in \mathbb{N}$ $a\in\mathbb{Z}_p$ $p$ is a large prime number Note that: By efficient I ...
• 183
4k views

### Diffie-Hellman Parameter Check: when g = 2, must p ≡ 11 (mod 24)?

I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). When I test some of the group ... 2k views

• 1,659
4k views

### How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
• 181
2k views

### Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
522 views

### Verifying Diffie–Hellman parameters someone else generated

I am auditing some software that includes compiled in Diffie–Hellman parameters (2048 bits). I can't be sure who generated the DH parameters or how they were generated. Question: Can DH parameters ...
• 203
1k views

### ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two p256-...
323 views

### How is a generator found for a group, both in case of DH & ECDH?

First step in DH & ECDH is to choose a random prime $p$. Then you choose a generator $g$ for the group $\mathbb Z_p^*$. How do you find a generator? Likewise in ECDH, you would need to find a ...
• 1,823
7k views

### Diffie-Hellman: choosing wrong generator "g" parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime $p$ and base $g$, which is primitive root $\bmod p$. Suppose that the generation algorithm is broken and $g$ generates only a ...
• 123
765 views

### Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$?

From https://en.wikipedia.org/wiki/Decisional_Diffie%E2%80%93Hellman_assumption: Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb {Z} _{p}^{*}$, where $p$ is prime....
• 813
2k views

### Is the additive discrete Logarithm problem always easy in Fields?

While thinking about additive DH key exchanges, I somehow had the idea that additive DH key exchange may always be easy to break, if we are in a field. So here's (directly) the question: In any ...
• 44.8k
625 views

### Why do the discriminant and primality of the group order of an elliptic curve affect security?

In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements. The ...
• 383
1k views

### Static Diffie-Hellman in TLS

Static Diffie-Hellman (cipher suites with DH in their name but neither DHE or DH_anon - ...
• 173
4k views

### Problem on Elliptic Curve Point Doubling

Given an elliptical curve e.g. from “Understanding Cryptography” by Parr & Pelzl §9.2 Example 9.5: $y^2 = x^3 + 2x + 2~~~~ mod~17$ And given a primitive $P = (5, 1)$, the book indicates: We ...
42k views

### What's the fundamental difference between Diffie-Hellman and RSA?

What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
• 1,279
39k views

### How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
• 421
10k views

### Explanation of the Decision Diffie Hellman (DDH) problem.

I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. ...
• 525
24k views

### Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
• 383
8k views

### Why do we need Diffie Hellman?

Diffie–Hellman offers secure key exchange only if sides are authenticated. For authentication, sides are using public/private key. So if side A knows the public key of the side B, then A can simply ...
• 263
2k views

### some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
• 1,252
6k views

### Does the generator size matter in Diffie-Hellman?

For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
• 572
8k views

### What Diffie-Hellman parameters should I use?

After reading this article, I started wondering how should I approach the problem of choosing p and g params in 1024-bit Diffie-Hellman key exchange. In my project, I am going to establish keys ...
• 336