Skip to main content

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

150 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
14 votes
0 answers
984 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
kelalaka's user avatar
  • 49.1k
7 votes
0 answers
287 views

How many qubits are required to break classical Diffie-Hellman?

There have been comparisons between RSA and ECDH with regards to the number of qubits required to break the algorithm with a specific key size. But how many qubits are required to break "...
Maarten Bodewes's user avatar
  • 93.4k
6 votes
0 answers
174 views

About a SETUP mechanism on ECDH

I'm following these three articles: Kleptography: Using Cryptography Against Cryptography, Kleptographic Attack on Elliptic Curve Based Cryptographic Protocols and Elliptic Curve Kleptography . In ...
Davide Motta's user avatar
6 votes
0 answers
301 views

Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
Bob Semple's user avatar
6 votes
0 answers
413 views

Precomputation attacks against ECDH

Diffie-Hellman groups are vulnerable to sieving precomputation attacks. These attacks allow a one-time computation against a given DH modulus that makes it practical to attack all subsequent key ...
forest's user avatar
  • 15.4k
5 votes
0 answers
123 views

Are all MNT curves assumed to hold XDH?

For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT ...
alwaysn00b's user avatar
5 votes
0 answers
1k views

How does post quantum key exchange in OpenSSH 8 work?

OpenSSH 8 supports a post quantum KEX, namely [email protected] It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
xkcd's user avatar
  • 260
4 votes
0 answers
186 views

Are there any projects leveraging a combination of (1) Noise and (2) Signal / Double Ratchet to augment the former with per-message forward secrecy?

Are there examples (in code, or a blog post / writeup) of using Noise and Signal together? Here is a link to Noise. For example, using the Double Ratchet per each message to achieve forward secrecy, ...
user3325588's user avatar
4 votes
0 answers
296 views

Where do the PKs come from in Bluetooth device?

I am studying the Elliptic Curve Diffie-Hellman (ECDH) on Bluetooth 4.2. There are some questions about the PK.. Where do these public and private keys come from? Who defines them? and Will it be ...
Claire Liu's user avatar
4 votes
0 answers
356 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
esneider's user avatar
  • 141
4 votes
0 answers
306 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
cowlicks's user avatar
  • 151
3 votes
0 answers
147 views

Compute key size in Hyperelliptic Curve Cryptography

I am trying to implement a basic Diffie-Hellman key exchange using ECC and HECC of genus 2 and 3 and compare them. However, I am a bit confused about the concept of key size in HECC. In ECC, from my ...
PanosDgs's user avatar
3 votes
0 answers
148 views

Solving DDH from an ElGamal adversary

Suppose an adversary wins IND-CPA against ElGamal, They're given public key $h=g^x$, Give a pair of messages $m = [m0,m1]$, Get back ciphertext $(a,b) = (g^r, g^{xr} \cdot g^{m[b]})$, from which ...
bs-'s user avatar
  • 83
3 votes
0 answers
105 views

Decisional Diffie-Hellman Assumption on Pairing Friendly Curves

It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH ...
Sean's user avatar
  • 99
3 votes
0 answers
245 views

Decisional Diffie-Hellman Assumption over Group of Quadratic Residue

Consider the Decision Diffie-Hellman (DDH) over $QR_n$ (the quadratic residue group over $n=pq$ where $p$ and $q$ are safe primes).According to Boneh's paper, DDH should be hard over $QR_n$ (https://...
Sean's user avatar
  • 99
3 votes
0 answers
191 views

Strong Diffie-Hellman Problem

While reading the following paper about the Strong Diffie-Hellman Problem, i got curious about ways to compute $ g^{x^{l}} $ for unknown $x$ in an elliptic curve, without first solving the discrete ...
ASP's user avatar
  • 31
3 votes
0 answers
741 views

Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
Titanlord's user avatar
  • 2,337
3 votes
0 answers
173 views

Key strength comparison: symmetric key vs RSA/DH key

I came across different reputable sources quoting different equivalent symmetric key strengths for RSA/DH keys. This NIST paper (page 67) states the following offer corresponding security strenghts (...
user avatar
3 votes
0 answers
821 views

Why Kerberos isn't using Diffie-Hellman key exchange?

Kerberos transforms the user password to obtain a secret key, which is also stored in the kerberos database. That way what travels through the network is the derived key, not the password itself, ...
Bozho's user avatar
  • 171
3 votes
0 answers
83 views

Difference between group key agreement, group key sharing, group key distribution and group key establishement

I am currently doing a survey on group key, and throughout my readings, I stumbled on these different terms: Group Key agreement, Group key Sharing, Group key distribution, and Group key establishment....
vxek's user avatar
  • 477
3 votes
0 answers
97 views

Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection. There is a ...
Maarten Bodewes's user avatar
  • 93.4k
3 votes
0 answers
2k views

GPG implementation of ECC "Encryption" (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
Woodstock's user avatar
  • 1,434
3 votes
0 answers
225 views

Reduction from integer factoring to computational Diffie Hellman

The computational Diffie Hellman (CDH) problem for ${\mathbb{Z}}^*_p$ is given a prime $p$, a generator $g$ of ${\mathbb{Z}}^*_p$, and a pair $(g^i, g^j)$ to compute $g^{ij}$. The value $g$ is called ...
duckstar's user avatar
  • 269
3 votes
0 answers
83 views

Assuming the difference between success probabilities to be positive

Context: I am currently studying Theorem 3.1 in the paper Number-Theoretic Constructions of Efficient Pseudo-Random Functions by Naor and Reingold. The theorem basically states the randomized self-...
Dave's user avatar
  • 131
3 votes
0 answers
375 views

Telegram VoIP key exchange

We've been trying to understand how Telegram's VoIP end-to-end encryption works. Key Exchange Detailed description of the key exchange algorithm is documented on the Telegram website. Here is the ...
Emil Melnikov's user avatar
3 votes
0 answers
1k views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
drdot's user avatar
  • 359
3 votes
1 answer
359 views

DH Key Exchange

I am trying to implement DH using Python (for tests), and its working for (3 ^ random_number) mod 17 In order to be secure, the prime (in this case, 17) needs to be very long. My question is: ...
0U0p0-0t0o0-0d0a0t0e0's user avatar
2 votes
0 answers
79 views

Tor Key Exchange Client - Middle Node

I am currently exploring the workings of the Tor network, specifically how the Diffie-Hellman (DH) key exchange protocol is employed to establish shared secret keys between the client and each relay ...
Elian's user avatar
  • 21
2 votes
1 answer
117 views

Is Message Layer Security the state of art protocol for group encryption?

I'm trying to read about Diffie Hellman (One to One) kind of protocols for group communication. Is Message Layer Security the state of art protocol for group encryption (not necessarily chat or ...
Genie's user avatar
  • 83
2 votes
0 answers
49 views

A tensor-based Diffie-Hellman exchange

Below is a description of a "cube" Diffie-Hellman, based on commuting matrix actions on tensor products. Some questions: References for something similar? Obvious flaws, is this a terrible ...
yoyo's user avatar
  • 420
2 votes
0 answers
141 views

Explanation of Burmester-Desmedt group key exchange and Ingemarsson-Tang-Wong (ITW) group key exchange algorithm

I know that both algorithms are similar to the Diffie-Hellman key exchange and are used for exchanging secret keys in a group but I still cannot figure out the key differences between both algorithms. ...
Haidepzai's user avatar
  • 121
2 votes
0 answers
71 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
kirelagin's user avatar
  • 206
2 votes
0 answers
65 views

Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
Adam Stanisław Jagielski's user avatar
2 votes
0 answers
1k views

How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?

I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key ...
Demento's user avatar
  • 121
2 votes
0 answers
86 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
auxten's user avatar
  • 121
2 votes
0 answers
1k views

What ECDSA key is used to sign the ECDHE key exchange?

I have a server using TLS1.2 with an ECDSA certificate using secp256r1. The algorithms being used to connect to my browser are TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as I expect from my server ...
Brian's user avatar
  • 21
2 votes
0 answers
103 views

Are there any one-way operations that could be used for Diffie-Hellman post-quantum? (See criteria)

With quantum-computers looming, there is a need for Public Key Cryptosystems that can withstand attacks by quantum-computers. Are there any known one-way operations that fit the following criteria? ...
wispi's user avatar
  • 203
2 votes
0 answers
1k views

Is Diffie-Hellman key exchange for multiple parties used in practice?

After reading this question about the possibility of using DH key exchange for multiple parties I went looking for a (C) library able to do this and found none. (I find it hard to believe there is no ...
Daniel's user avatar
  • 141
2 votes
0 answers
480 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
izac's user avatar
  • 89
2 votes
0 answers
411 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
juaninf's user avatar
  • 2,731
2 votes
0 answers
222 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
d33tah's user avatar
  • 363
2 votes
0 answers
147 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
Bob White's user avatar
2 votes
1 answer
555 views

What is the correct way to use HKDF with X25519?

I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF. Initially, I ...
Eri's user avatar
  • 31
1 vote
0 answers
51 views

Proof that Inverse CDH and Square CDH are equivalent

I am trying to prove said equivalence, but when proving SCDH -> ICDH using a reduction, I get stuck since I don't know how to compute $g^{x^2}$ starting from $g^{x^{-1}}$. Suppose exists $A_{ICDH}$ ...
Pietro D'Amico's user avatar
1 vote
0 answers
62 views

Is the following Inverse Computational co-Diffie-Hellman problem hard?

Let $\langle g \rangle \stackrel{\Delta}{=} \mathbb{G}$ and $\langle h \rangle \stackrel{\Delta}{=} \mathbb{H}$ be groups of prime order $p$. Given $( p, g, g^\delta, g^{\delta^{-1}}, h, h^\delta )$, ...
honest-but-curious's user avatar
1 vote
1 answer
80 views

What's the difference between these two attacks?(Lim Lee and Sub group) I am a beginner can someone explain in detail?

I am reading collin boyd textbook to learn MTI key agreement and various attacks on them . I encountered two such attacks called Small sub group attack and Lim-Lee attack where in Small sub group ...
whatisLimlee's user avatar
1 vote
0 answers
135 views

Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
Logan R. Kearsley's user avatar
1 vote
0 answers
69 views

Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?

Motivation I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
Richard Thiessen's user avatar
1 vote
0 answers
47 views

Variant of Decisional Diffie Hellman

Given a cryptographic prime $p$ and a generator $g$ of $\mathbb{F}_p$, the Decisional Diffie Hellman problem asks us to distinguish $(g^a, g^b, g^{ab})$ from $(g^a, g^b, g^z)$ for random $a, b, z$. ...
Krijn's user avatar
  • 115
1 vote
0 answers
495 views

How to calculate points for twist?

How I can find the point to perform this twist attack - https://cryptodeep.ru/twist-attack/ English version of previous link: https://github.com/demining/Twist-Attack This video has additional ...
Matiy's user avatar
  • 29