# Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

1,088 questions
Filter by
Sorted by
Tagged with
1 vote
197 views

### Why using q = (p - 1)/2 for discrete log Diffie-Hellman scalar operations and not p?

As defined in RFC 3526 the prime $p$ and generator $g$ are known. The prime $p$ defined there is a safe prime, which can also be expressed as $p=2q+1$ with $q$ prime. The amount of elements in this ...
• 121
1 vote
162 views

### DH Encrypt by XOR

I'm working in the Curve25519 domain (EC curve, 256-bit key size). I have a peer pubkey, and need to send it an encrypted message. For starters we create a "nonce" (ephemeral key), and use ...
• 359
1 vote
289 views

### How do I find the order of the subgroup in a Diffie-Hellman key exchange?

I'm implementing the Diffie-Hellman key exchange as specified in RFC 4253 for SSH. Here's an extract from the RFC: The following steps are used to exchange a key. In this, C is the client; S is the ...
1 vote
51 views

### Proof that Inverse CDH and Square CDH are equivalent

I am trying to prove said equivalence, but when proving SCDH -> ICDH using a reduction, I get stuck since I don't know how to compute $g^{x^2}$ starting from $g^{x^{-1}}$. Suppose exists $A_{ICDH}$ ...
1 vote
62 views

### Is the following Inverse Computational co-Diffie-Hellman problem hard?

Let $\langle g \rangle \stackrel{\Delta}{=} \mathbb{G}$ and $\langle h \rangle \stackrel{\Delta}{=} \mathbb{H}$ be groups of prime order $p$. Given $( p, g, g^\delta, g^{\delta^{-1}}, h, h^\delta )$, ...
17 views

### Safety per bit DHKA and ECDH

I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
32 views

### Is the MITM protection provided by BLE LESC passkey mechanism bidirectional?

I'm trying to understand whether the passkey mechanism described in BLE LESC pairing provides bidirectional MITM protection. As far as I understand, A and B will generate the same shared secret using ...
66 views

### diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
38 views

### How some auxiliary information influence the CDH assumption?

I am proposing a multi-party group-key agreement protocol in my paper, which can be seen as an extension of the classic Diffie Hellman bipartite group key agreement. However, how to formalize the ...
47 views

### Is shared secret and SKEYID are same in the IPSec?

I want to know that, is shared secret and SKEYID are same in the IPSec? I knew that from SKEYID, three further keys are generated (derivative, authentication and encryption). But from where this ...
114 views

### How do I solve a discrete log using pen paper for exam without bruteforcing it?

I have my Network Security finals. In elgamal cryptosystem, I am often encountering these equations like this 3 = (10^XA) mod 19 now everywhere I am finding only ...
• 141
4k views

### Why does it take longer to generate suitably large primes for Diffie-Hellman key exchange as opposed to for RSA encryption / decryption?

For RSA, we need two primes p and q to define N = pq. We will only look how long it takes to generate a prime for p because the process is similar for q. From my lecture slides, my professor states ...
1 vote
72 views

### Is it possible to use Diffie-Hellman protocol for symmetric group?

I was asked this question during one of my first cryptography classes, and I'm not sure if I understand it correctly. To begin, I know that after using the Diffie-Hellman protocol (which itself is ...
1 vote
80 views

### What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
36 views

### Sending public key trough untrusted server

I am developing end-to-end encrypted chat system (which is open-source). When I want to give other client my public key, I need to send it trough server, right? I want to make sure no one can edit the ...
1 vote
137 views

### Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
107 views

1 vote
100 views

### Efficiently detect that a ciphertext is meant for Alice

Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
91 views

### Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]

I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
• 33
1 vote
462 views

### Why does ECIES use "Key Encapsulation"? Does it?

In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
• 93.5k
1 vote
203 views

### In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides? For example can I use secp521r1 at the ...
• 33
71 views

### On a problem assuming Diffie-Hellman oracle

If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$. Can we construct $g^{x^{-1}}$ given $g^x$?
• 930
117 views

### Is Message Layer Security the state of art protocol for group encryption?

I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or ...
• 83
555 views

### What is the correct way to use HKDF with X25519?

I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF. Initially, I ...
• 31