Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Inquiries on Strong Diffie-Hellman assumption

According to the SDH assumption, it is hard for an adversary to output a pair $(c,g_1^{\frac{1}{c+\alpha}})$ given a $q+2$ tuple ($g_1$,$g_2$,$g_2^{\alpha}$, ...,$g_2^{{\alpha}^q}$) Now, consider $g_1$...
Mahmoud Abdelsatar's user avatar
0 votes
0 answers
40 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
unalignedmemoryaccess's user avatar
2 votes
2 answers
78 views

One group element hybrid encryption for El Gamal

I am really curious about this one problem 10.12 from Katz/Lindell's book. It goes as follows: I am quite sure we can assume that $\textsf{Enc}_k(m) \in \mathbb{G}$, as the authors devoted the whole ...
Michael Hammer's user avatar
1 vote
1 answer
23 views

Use of CertificateVerify in TLS_DH_RSA with client authentication?

Does anyone know if CertificateVerify is sent in TLS_DH_RSA with client authentication? Does anyone know the RFC or could explain the meaning of it? With TLS_RSA, a ...
user946822's user avatar
1 vote
1 answer
72 views

Signed vs unsigned prekeys

I am trying to understand the signal protocol better. I spend some time trying to understand their codebase (the backend is written in java). The signal protocol indicates that the user has to upload ...
Farhan Syedain's user avatar
1 vote
2 answers
157 views

Is this self algorithm made private key for Diffie-Hellman key exchange secure

i created a function in javascript that creates my a for the DH exchange like this: ...
Moritz Fesseler's user avatar
1 vote
1 answer
51 views

Similar to Diffie Hellman for BLS in asymmetric pairing?

I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
Manish Adhikari's user avatar
0 votes
0 answers
77 views

Generating a new curve using an existing curve and new prime

Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user avatar
2 votes
3 answers
202 views

Is any safe prime sufficient for a secure DH key exchange?

There are some very large safe primes listed here: https://en.wikipedia.org/wiki/Safe_and_Sophie_Germain_primes Would using any of them result in a secure DH construction? Generator is 2. The exponent ...
user avatar
2 votes
0 answers
65 views

Tor Key Exchange Client - Middle Node

I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
Elian's user avatar
  • 21
0 votes
0 answers
51 views

which DH protocol is safer in communication with given condition?

I am trying to understand some concepts such as DH problem and its variants. I have the following question from the book I read. (note that I translated the question from my language to english) ...
user avatar
0 votes
2 answers
326 views

Are Safe and Sophie Germain primes evenly distributed?

Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value? This is important in one area of triangular ...
Zekchelovek's user avatar
0 votes
0 answers
74 views

Distinguishing between two DDH-like tuples

Given a group generator $g$ (in a group where DDH is hard). Let $X_1=g^{x_1}$ and $X_2=g^{x_2}$ be two public elements, where $x_1$ and $x_2$ are selected randomly and kept secret. Consider a game ...
Doron's user avatar
  • 99
1 vote
0 answers
68 views

Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?

Motivation I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
Richard Thiessen's user avatar
1 vote
1 answer
355 views

DHKE: Why using safe prime gives us "safe" subgroups?

I come from the question here: Safe primes subgroup in Diffie–Hellman key exchange Where the accepted answer states that there are only 4 possible outcomes for the order of a subgroup when using a ...
Ymi's user avatar
  • 175
3 votes
2 answers
136 views

What is the difference between Post-Compromise Security and Backward Security?

Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain ...
Guardzhan's user avatar
3 votes
1 answer
131 views

Separation between CDH and DDH

Do there exist cryptographic primitives that have proved that they cannot be constructed from CDH assumption only but can from DDH assumption? More generally, do there exist cryptographic primitives ...
misosiru's user avatar
1 vote
1 answer
83 views

How often do Double ratchet in Signal protocol update DH ratchet key

I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet. According to wiki: A client renews session key material in interaction with the remote peer using ...
pacman's user avatar
  • 429
4 votes
1 answer
335 views

How does the Legendre symbol reveal if $g^a$ is odd or even for Finite Field Diffie-Hellman

According to wikipedia(markdown is striped below) for Decisional Diffie–Hellman assumption: the DDH assumption does not hold in the multiplicative group $Z(p)$, where $p$ is prime. This is because if ...
pacman's user avatar
  • 429
0 votes
1 answer
138 views

Safe primes subgroup in Diffie–Hellman key exchange

I'm trying to understand how the safe primes numbers are used in Diffie–Hellman key exchange. According to wiki: The order of G should have a large prime factor to prevent use of the Pohlig–Hellman ...
pacman's user avatar
  • 429
0 votes
0 answers
49 views

Could ECDH-OPRF-PSI support private information retrieval?

Alice:has $x=(x_1,x_2,...x_m)$ Bob: has $(y_1,m_1),...,(y_n,m_n)$ For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets Bob generate random $a \in Z_q$,$...
haoxuan li's user avatar
1 vote
2 answers
93 views

Efficiently detect that a ciphertext is meant for Alice

Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
user avatar
0 votes
1 answer
71 views

Does TLS1.3 support DHE_EXPORT cipher suite? [duplicate]

I just wanted to know for sure that TLS 1.3 does not support DHE_EXPORT cipher suits.
warren's user avatar
  • 33
1 vote
2 answers
256 views

Why does ECIES use "Key Encapsulation"? Does it?

In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
Maarten Bodewes's user avatar
  • 92.3k
1 vote
1 answer
120 views

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides? For example can I use secp521r1 at the ...
warren's user avatar
  • 33
0 votes
1 answer
63 views

On a problem assuming Diffie-Hellman oracle

If we have a Diffie-Hellman oracle then given $g^x$ and $g^y$ we can construct $g^{xy}$. Can we construct $g^{x^{-1}}$ given $g^x$?
Turbo's user avatar
  • 908
2 votes
1 answer
100 views

Is Message Layer Security the state of art protocol for group encryption?

I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or ...
Genie's user avatar
  • 83
2 votes
1 answer
328 views

What is the correct way to use HKDF with X25519?

I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF. Initially, I ...
Eri's user avatar
  • 31
3 votes
1 answer
259 views

Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?

Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs: NodeJS: ...
fadedbee's user avatar
  • 916
1 vote
2 answers
271 views

What's the catch with this Diffie-Hellman based cryptosystem?

This is most likely a dumb question. I'm doing a mathematical research project that overflowed a bit into cryptography. It got me thinking about something. Can the following cryptosystem work? Let ...
TheBestMagician's user avatar
0 votes
0 answers
128 views

Which encryption/decryption to use with ECC?

I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
minion's user avatar
  • 1
3 votes
1 answer
111 views

Big prime factor of the prime number you feed to Diffie Hellman

They say the security of Diffie-Hellman depends on the factorization of (N-1), where N is the big prime number you feed it. More specifically, (N-1) itself has to have a big prime factor, such as (N-1)...
Kevin Stefanov's user avatar
1 vote
1 answer
99 views

Is it possible to have a shared secret between an unlimited number of parties asynchronously?

Let's say I encrypt a message with some secret and store it in a database. Later, I want to securely share that secret with someone, so that they can read the message as well. Even later, I want to ...
dodov's user avatar
  • 111
1 vote
1 answer
75 views

Diffie-Hellman key exchange for $n + 1$ parties

Suppose that there are $n+1$ parties - $B,A_1,A_2,...,A_n$ that want to share a secret key The protocol of exchanging is roughly the same as Diffe-Hellman Chose a group $G$ with an order of $p$ - a ...
Kain's user avatar
  • 113
0 votes
1 answer
52 views

(type-3) Variant of the decisional Diffie-Hellman

At a high level, the Uber assumption states that it is not possible to compute (distinguish) linearly independent elements. In the decisional version, the problem is restricted to $G_T$, but it is ...
nobrand's user avatar
0 votes
2 answers
86 views

Key exchange from discrete logarithm only

Diffie-Hellman key exchange is sometimes informally said to be hard under the discrete logarithm assumption in the chosen group. But if I am reading literature correctly, it actually uses a stronger ...
Ilk's user avatar
  • 233
1 vote
1 answer
176 views

Why is static-static diffie hellman needed in Noise_IK?

TL;DR: Why is there a static-static diffie hellman in the Noise_IK handshake? Hi, I am currently trying to understand the WireGuard VPN protocol. As you may know, it uses the Noise_IK handshake from ...
Henerii's user avatar
  • 13
3 votes
1 answer
487 views

How does TLS 1.3 restrict the Diffie-Hellman parameters to ones that are known to be secure?

In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations ...
user10433098's user avatar
5 votes
2 answers
188 views

Authenticated encryption scheme for one-way radio telemetry

I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
Polynomial's user avatar
  • 3,527
3 votes
2 answers
201 views

"Supported groups" in RFC 8446 (TLS 1.3)

What is meant by "supported groups" in the section 4.2.7. "Supported Groups" of RFC 8446: /* Finite Field Groups (DHE) */ ffdhe2048(0x0100), ffdhe3072(0x0101), etc: Is the digits - ...
LUN's user avatar
  • 95
3 votes
1 answer
644 views

How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?

Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it. My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
ceaaj's user avatar
  • 33
2 votes
1 answer
48 views

Two way key transport?

For a KEM mechanism like RSA, Kyber, etc. is there it usually worth doing key trapping/key encapsulation both directions in a key exchange? By this I mean: Alice wraps a symmetric key and sends it to ...
Joe's user avatar
  • 73
3 votes
1 answer
85 views

Is there a standard I can test a ECDH against?

I have a program in Python to do the ECDH with the NIST P-256 curve. The program is seemingly working, ie I get the same private key pair at the end. But I want to make sure it's not a coincidence in ...
Lachlan's user avatar
  • 101
1 vote
1 answer
95 views

DH Finding A Public Key from Public key and shared secret

Is there a known feasible method for determining an unknown public key from a Diffie Helman shared secret and the other public/private key pair? This would be rarely useful, but I am curious if the DH ...
Wesley Jones's user avatar
2 votes
1 answer
459 views

Is pairing-based crypto post-quantum secure?

Bilinear Pairings are widely used in many new schemes like Group Signature and Aggregate Signature. The problem is whether it is post-quantum secure. In other words, does Bilinear Diffie-Hellman ...
Chunchi Liu's user avatar
6 votes
1 answer
519 views

What's wrong with this simple reduction of discrete logarithms to the Diffie-Hellman problem?

This recent paper shows that discrete logarithms are solvable if you have an oracle for the Diffie–Hellman problem. However, to me, it seems there is a much simpler reduction and I wonder where I am ...
RobinLinus's user avatar
3 votes
0 answers
135 views

Compute key size in Hyperelliptic Curve Cryptography

I am trying to implement a basic Diffie-Hellman key exchange using ECC and HECC of genus 2 and 3 and compare them. However, I am a bit confused about the concept of key size in HECC. In ECC, from my ...
PanosDgs's user avatar
1 vote
0 answers
59 views

How can I perform a one-client MITM attack in a Diffie-Hellman key exchange? [closed]

Suppose we have intercepted a public key exchange (via Diffie-Hellman protocol). In addition to the keys A and B, the generator g and the module p are known. Assuming that it is possible to exchange ...
Albert's user avatar
  • 11
0 votes
1 answer
484 views

ECDH security vs. type of elliptic curve

While using ECDH key exchange, we can choose to use different kind of elliptic curve, e.g. P224, P256 or P384 etc. (btw, I am using go). My question is, what is the criteria to choose different kind ...
xrfang's user avatar
  • 139
1 vote
0 answers
35 views

How to design a Zero-Knowledge Proof of a message in a certain range? [duplicate]

Given a message $m$, how can I prove that $m$ lies between 0 and 31 without revealing the message using a Sigma protocol? The message is encrypted as: $$c = a^{\beta} \cdot g^m ,$$ where: $a$ is the ...
Daniel Chan's user avatar

1
2 3 4 5
22