Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
2 votes
1 answer
72 views

How does this libgcrypt elgamal decryption work?

Update: The question below was asked before I realized that this is being done to prevent a side channel attack: https://github.com/advisories/GHSA-5p8v-2xvp-pwmc What I am still curious about, is the ...
  • 155
0 votes
1 answer
34 views

Trying out the small subgroup attack on a group of non-prime order using a simple additive group instead of an Elliptic Curve Group?

This is the attack I am talking about - Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? An elliptic curve group of order $8p$ where $p$ is a prime. Let $G$ be the ...
  • 1,823
0 votes
2 answers
177 views

In a Diffie-Hellman key exchange Find this key and compute the shared secret key k

Hi I struggling to find the answer of my schhol exam, can anyone help me . In a Diffie-Hellman key exchange the multiplicative group of integers modulo p is used with the parameters p = 59, g = 3 mod ...
  • 3
2 votes
1 answer
75 views

Commutable and Composable Asymmetric Encryption/Decryption

I have a need for the following encryption properties: $f(g(v_\text{plaintext}) = v_\text{ciphertext}$ needs to be decryptable by $f^{-1}(g^{-1}(v_\text{ciphertext}))$ and $f$ and $g$ need to be ...
3 votes
1 answer
225 views

Understanding the small cofactor attack with Elliptic Curves of non-prime order

I came across 2 older answers (2 different but similar questions on the small cofactor attack) which cover this attack. https://crypto.stackexchange.com/a/12614/3941 Here the attacker replaces the $...
  • 1,823
1 vote
1 answer
380 views

Diffie-Hellman over $GF(2^{128})$

Can I use Diffie-Hellman over, say, $GF(2^{128}) \bmod$ irreducible poly in $GF(2^{128})$ instead of $GF(p)$? If not, why? Or increase it to $GF(2^{2^{\text{whatever}}})$.
0 votes
1 answer
104 views

How is Diffie-Hellman linked to AES?

I have just learnt about Diffie-Hellman and AES. However, I cannot seem to understand how they link. My initial idea was that Diffie-hellman is used to transfer a key for AES decryption. After further ...
  • 3
2 votes
2 answers
166 views

ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
2 votes
1 answer
172 views

Where is the definition of one-way trap-door function used in public key cryptography

This is a rather simple question but I've been unable to find a proper answer for this online. When defining an asymmetric (public key) algorithm is the one-way trap-door function usage referring to ...
2 votes
2 answers
66 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
0 votes
0 answers
17 views

Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
0 votes
1 answer
37 views

How is the shared secret generated in IPsec using DH key generation?

I have doubt like when in the IPsec we use a DH group for key exchange. It takes a prime number and $g$ value from group bit. How does the key exchange payload and nonce help to generate the shared ...
  • 1
0 votes
0 answers
57 views

What is the best choice of the base g in El-Gamal PKC

I have just read in a book that in El-Gamal PKC, the best choice of a base g is a number whose order in the field ($\mathbb{F}_p$) is a large prime, and added: "approximately = $\frac{p}{2}$"...
0 votes
1 answer
68 views

How SSL (similar version) works?

My book suggested the following protocol to replace SSL: A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
  • 5
-1 votes
1 answer
39 views

The benefit of the shared key generated from ECDH key exchange protocol [duplicate]

What the benefit of the shared key that generated from ECDH key exchange protocol? Can I use it to encrypt the message or encrypt the public key of asymmetric encryption?
0 votes
0 answers
24 views

The appropriate smoothness bound

My question roots from another question asked in the community since I do not have enough reputation points to comment on the answer, I was hoping I could ask it here. How was the individual asking ...
0 votes
0 answers
51 views

How to reduce Diffie Hellman problem to ElGamal?

I'm trying to answer without success questions (ii - iv) Any hint will be appreciated :)
0 votes
0 answers
21 views

Looking for multi-party key exchange/shared secret algorithm with specific requirements

I'm looking for the ability to create a SINGLE CONSTANT shared secret amongst two or more users (a group) AND if a new user is added to such a secured group the new user should also be able to learn ...
  • 169
0 votes
2 answers
69 views

What E means in Diffie Hellman protocol?

I was looking for an example of protocol to verify user's identity using Diffie Hellman which works like this: client sends: $g^x$, ...
  • 5
0 votes
2 answers
132 views

Why do we need to use Asymmetric cryptography if Diffie-Hellman solves the key exchange problem of symmetric cryptography?

I am new to cryptography and I cant get my head around this issue: If symmetric cryptography is faster then asymmetric and given that Diffie-Hellman key exchange algorithm allows you to exchange keys ...
  • 47
1 vote
0 answers
56 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
1 vote
1 answer
112 views

Sending encrypted message without public key from recipient (elgamal)

assume Bob and Alice use Elgamal encryption scheme. Alice wants to send Bob a message, but does not know Bobs public key. Is there a way for Alice to find out Bobs public key by receiving multiple ...
1 vote
2 answers
123 views

Can a MITM during Diffie-Hellman key exchange manipulate both sides to generate symmetric secrets?

Is it possible for an attacker on a Diffie-Hellman key exchange to manipulate both sides in a way so that the secret generated on each side is identical? Or put differently, would it be possible to ...
  • 13
2 votes
1 answer
85 views

Could anyone explain what Two Oracle Diffie-Hellman assumption is?

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already ...
0 votes
1 answer
73 views

What's the meaning of asterisk and PPT in this paper?

I'm very new to cryptography. I'm required to read a paper. I totally don't understand. First, what's the meaning of the asterisk in $H:\{0,1\}^*\rightarrow \{0,1\}^k ?$. Second, what does PPT mean ...
0 votes
1 answer
114 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
1 vote
1 answer
64 views

Can Bob and Alice do an authenticated Diffie–Hellman key exchange if Bob only knows the hashsum of Alice's key?

Tor vanilla bridges look like this: Bridge x.x.x.x:1234 9DD03662B50FEDBF6F8D5630CB86D7E8CE4F4432 It's only the IP/Port and a hash of the key. Can Bob and Alice do an authenticated Diffie–Hellman key ...
2 votes
1 answer
64 views

Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

Let's suppose that Bob has only Alice's IP and no more information about Alice's key, nor the digest of Alice's key. They exchange keys and need proof that the received keys are the same keys that ...
1 vote
1 answer
84 views

Tree Parity Machines (neural cryptography) advantages

It seems that neural cryptography is an interesting research topic and there are some important contributions published in the last years. The proposed algorithms are suitable for symmetric key ...
  • 11
0 votes
1 answer
189 views

64 bit key size Diffie Hellman

I am building a cryptographic El Gamal implementation on the Cardano Blockchain for a poker game. Each hand the players generate a DH 64 bit keys and shuffle the cards together via homomorphic ...
  • 101
1 vote
1 answer
52 views

How do I ascertain the key length of some Diffie Hellman moduli to counteract the Log Jam vulnerability?

I have the following Diffie-Hellman ciphers on one of my servers ...
1 vote
1 answer
55 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
  • 51
1 vote
1 answer
47 views

Division by $2$ or principal root with DH oracle

Assume $g$ is generator of multiplicative group modulo prime $p=2q+1$ where $q$ is prime. Assume we know $g^{2t}\bmod p$ and $g^{2}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. ...
  • 882
2 votes
1 answer
93 views

Breaking CDH also breaks DHI

I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
  • 35
0 votes
1 answer
82 views

RSA Encryption and ECDH in OpenPGP

According to RFC4880 standard 1.Refer to section 2.1 Confidentiality via Encryption --> OpenPGP combines symmetric-key encryption and public-key encryption to provide confidentiality +To protect ...
  • 51
0 votes
0 answers
13 views

Distributing the Master Public Key in Identity-based Encryption systems

I was just wondering how the private key generator should publish the master public key inside of an IBE system. This key is needed for all devices in the network to derive the public key of receiving ...
0 votes
1 answer
54 views

What is the Diffie Hellman session key used for in IPsec protocol?

Let's say we choose AES as cryptographic algorithm for IPsec. My question is the following Is the key produced by Diffie-Hellman algorithm used as INPUT to the AES algorithm so AES does the ...
2 votes
1 answer
150 views

Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
1 vote
2 answers
65 views

Is there a standardized way to evaluate the security of a key exchange algorithm?

I'm now trying to design a more secure key-change algorithm to replace widely used DH. However, I am only able to prove that my algorithm is more secure logically, which means I can only prove it from ...
  • 41
1 vote
2 answers
34 views

Definition of Multilin DDH

I am on the abbreviation mutlin. DDH, which probably stands for mutliniear Decision Diffie Hellmann. I am currently looking for a definition for this term, but unfortunately cannot find a source. Can ...
  • 23
1 vote
2 answers
185 views

Definition of the strong Diffie Hellman problem

I am looking for the definition of the strong Diffie Hellmann problem. However, I can only find definitions for the $\ell$ or $q$-strong Diffie Hellmann. Is it possible that the strong Diffie Hellman ...
  • 23
1 vote
1 answer
135 views

What is ECDH used for in BLE Authentication?

I am currently new to the world of BLE and I came across this article which mentions ECDH. In the diagram in part $3$, it generates the DHKey/shared secret (I am assuming this is the correct ...
  • 111
4 votes
2 answers
2k views

I don't see how a ECDH is useful

I'm having a hard time understanding the usefulness of using an ECDH over traditional asymmetric encryption. Both parties have to exchange public keys to compute the ECDH, so why wouldn't they just ...
  • 143
3 votes
2 answers
171 views

Common exponent problem related to discrete logarithms assuming Diffie Hellman oracle

Let $g$ be a generator of multiplicative group mod $p$ a prime. Suppose we know $$g^{a+km_1}\bmod p$$ $$g^{b-km_2}\bmod p$$ $$g^{a+k'm_3}\bmod p$$ $$g^{b-k'm_4}\bmod p$$ where $m_2m_3-m_4m_1=\phi(p)$ ...
  • 882
5 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
  • 73
2 votes
1 answer
74 views

How small is the negligible advantage for DDH?

The well known Decisional Diffie Hellman assumption (DDH) assert that for any $n = \log q$ and generator $g$ of $\mathbb{Z}_q$, for uniformly i.i.d $A, B, C \sim U(\mathbb{Z}_q)$, the following are ...
  • 113
1 vote
1 answer
83 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
0 votes
1 answer
27 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8 in ACVP

Hi I found this question which I am currently struggling with. How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8? In ACVP, the input diffe-hellman shared secret ...
  • 1
1 vote
1 answer
86 views

On access to a Diffie Hellman oracle

Assume $g$ is generator of multiplicative group modulo prime $p$. Assume we know $g^X\bmod p$ and $g^{XY}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. Can we find $g^Y\bmod p$ in ...
  • 882
0 votes
0 answers
56 views

Security of a variant of DDH

The standard DDH assumption states that given $(g,g^a,g^b,g^c)$, it is hard to determine whether $c$ is $ab$ or not. A variant of DDH assumption is: given $(g,g^a,g^b,g^c, g^{ab} ,g^{bc},g^{ac})$, it ...

1
2 3 4 5
20