Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
1 vote
2 answers
172 views

Symmetric key generation for ECDH

Trying to implement a mechanism for one way transmission of encrypted string values using ECC. Assume there is a fixed secret unavailable private key FPK, and public key FP for it is available to the ...
1 vote
1 answer
269 views

Security of McCallum-Relyea exchange

I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key. It was developed at RedHat and is used by the tang and clevis ...
  • 258
0 votes
0 answers
70 views

Proving a variation of CDH is hard

let $(\mathbb{G},q,p)$ be a group $\mathbb{G}$ with prime order $q$ and generator $g$. Assume that CDH is hard relative to this setup (Namely, given $(g,g^a,g^b)$, it is hard to find $g^{ab}$). Now ...
  • 21
2 votes
1 answer
294 views

Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
  • 23
2 votes
1 answer
333 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
  • 45
0 votes
1 answer
84 views

ECDHE without initial handshake

Is it possible to do a key agreement with ECDH ephemeral-ephemeral without requiring an initial handshake first? Is it possible to have the key agreement in the same message as the encrypted data with ...
0 votes
0 answers
37 views

Consequences of leaking one byte of an ECDH shared secret

An EC point $B$ is published publicly so that a recipient in possession of a scalar $a$ can calculate the shared secret $S = [a]B$. This is done with the Ed25519 curve. If the sender (who knows $b$ ...
  • 3,917
1 vote
0 answers
42 views

Performance of elliptic curve Diffie-Hellman vs NIST-PQC finalist KEMS

I am looking for performance measurements in cycle counts for an implementation of the elliptic curve Diffie-Hellman for curve, ed25519. Ideally, the cycle counts ...
1 vote
1 answer
388 views

Can Fixed–Diffie–Hellman be attacked?

Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
  • 113
0 votes
0 answers
52 views

Is it possible to create an algorithm for identification and key exchange using the diffie hellman algorithm with exactly three messages?

Suppose I want to create a new protocol for communication between two sides, I want to use the Diffie hellman protocol for exchanging keys & also want to do a few more steps later so that the ...
  • 13
0 votes
0 answers
74 views

Avoid MITM Attack in ECDH Without HTTPS or a Third Party Certificate Authority

My context: I have a ECHD protocol, my main concern is MITM attack, it doesn't matters if you do HMAC or anything else in future to sign requests if your key exchange is compromised, Far from https ...
1 vote
2 answers
71 views

Use of custom DH parameters for TLS decryption

There are several ways to decrypt TLS e.g. in an enterprise environment. I did not see using "backdoored" DH parameters being mentioned somewhere though according to my understanding it ...
1 vote
2 answers
113 views

How to find the extractor in the Knowledge-of-Exponent Assumption?

From Mihir Bellare's paper Let $q$ be a prime such that $2q +1$ is also prime, and let $g$ be a generator of the order $q$ subgroup of ${Z^∗}_{2q+1}$. Suppose we are given input $q$, $g$, $g^a$ and ...
  • 1,825
-1 votes
1 answer
64 views

Help me to solve 3 Pass DiffiHellman protocol

I am trying to solve 3pass Diffihellman problem. However, I could not solve it. Is there any specific rule exist to select a1 and b1 or problem in the calculation. Please help me to solve this problem....
0 votes
2 answers
164 views

How can I dentify the ECDHE group value used in a TLS session

In ECDHE, the group is a public value. I want to get this value for a session. I inspected the session using Wireshark. Under the ServerHello -> Key share extension -> Key share entry, I found ...
5 votes
1 answer
298 views

HKDF randomness extraction - salt or no salt?

According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction. This question is solely about the necessity of a salt for the purposes of randomness ...
  • 3,917
1 vote
1 answer
81 views

Hardness of a variant of the CDH problem

Given $g$, a generator of a multiplicative group (over some finite field or elliptic curve), and the group elements $\left( g^x, g^a, g^b, g^c, g^{x(a+b)}, g^{x(b+c)} \right)$, is possible to ...
  • 471
0 votes
0 answers
126 views

How to use ffdhe2048 in node js?

I am reading about Diffie Hellman key exchange from Real World Cryptography book and came across this For this reason, best practice nowadays is to use RFC 7919, which defines several groups of ...
0 votes
1 answer
172 views

Multiplication two points in elliptic curve cryptography [duplicate]

Are there references or prove to say that multiplying two points in the elliptic curve cryptography ECC is not allowed, as an example below? Multiply the public key PKA by a point (Z) on the ECC since ...
1 vote
0 answers
179 views

Cracking secret key, n, and m by hand with the Diffie-Hellman key exchange brute force

Problem: You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange. Michael and Nikita choose $p = 97$ and $g = 5$. Nikita chooses a random number n and tells Michael that ...
0 votes
1 answer
91 views

Why is it hard to compute $g^{xy}\bmod p$ from $g^x\bmod p$ and $g^y\bmod p$? [duplicate]

Why is it hard to compute $$(g^x\bmod p, g^y\bmod p) \longmapsto g^{xy}\bmod p $$ when can we quickly compute $$x \longmapsto g^x\bmod p$$ ?
4 votes
1 answer
180 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
  • 41
1 vote
1 answer
70 views

AWS IoT - Unique Keys per each device - Data encryption

(Probably not the right board to ask. But here goes) I'm designing an IoT Solution with RPi as client and AWS as the server. On the client hardware, I have an Security Chip that can securely generate ...
  • 11
0 votes
3 answers
107 views

mutual authentication in STS protocol

STS Protocol is like this: $A \rightarrow B:~ g^x$ $A \leftarrow B:~ g^y, E_K(S_B(g^y, g^x))$ $A \rightarrow B:~ E_K(S_A(g^x, g^y))$ My question is why do we say in STS we have mutual authentication?...
  • 33
2 votes
0 answers
46 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
  • 196
0 votes
1 answer
70 views

What Is The Maximum Value For N In Discrete Logarithm Problems?

I have some code, which can crack a discrete logarithm problem in ~ O(0.5n) time. However, this only works if, in the following, N is less than P: G^N (mod P). To be clear, my program can figure out ...
1 vote
0 answers
26 views

running Project Wycheproof against crypto implementations in languages other than Java

So I guess https://github.com/google/wycheproof "tests crypto libraries against known attacks". It appears to mainly be intended for Java crypto providers but can it easily be adapted to be ...
  • 2,805
1 vote
1 answer
91 views

How to know if you have guessed the correct Diffie-Hellman shared secret?

Given only $p,$ $g,$ $A = g^a\pmod{p}$ and $B = g^b\pmod{p},$ the possible values for the shared secret are all the unique values of $A^b\pmod{p}$, where b is some integer. The shared secret is also ...
2 votes
1 answer
93 views

Shortcut to working out Diffie-Hellman Key Exchange

I am trying to calculate Alice and Bob's shared key by hand without the use of a calculator as I feel this is an important trait when progressing into cryptography. I understand you can use the square ...
1 vote
0 answers
30 views

Is Diffie-Hellman less secure when A and B select the same random number? [duplicate]

I understand that it is feasibly impossible for A and B to select the same random number, given the large input space, but what if it does happen? Does it effect the security of the key exchange? Can ...
0 votes
1 answer
491 views

Is Diffie-Hellman Key Exchange an Asymmetric or Symmetric Algorithm? [duplicate]

To my understanding, the DHKE algorithm is symmetric since it only produces a shared secret, rather than public and private keys, however googling "is diffie hellman asymmetric?" results in ...
0 votes
1 answer
74 views

Computationally indistinguishability using DDH assumption

This is part of the explanation of the commitment scheme from DDH in this lecture notes by Vipul Goyal: https://www.cs.cmu.edu/~goyal/s18/15503/scribe_notes/lecture22.pdf My question is not directly ...
0 votes
1 answer
78 views

Are all public key a result of computing g^k mod p

I just read through the text book definition of Diffie–Hellman key exchange. And from what i understand, the public key that is shared based on the protocol is calculated from: ...
1 vote
1 answer
306 views

DDH to DLIN reduction

I read multiple times that it should be feasible to show a reductions from Decisional Diffie Hellmann. Could you give examples?
user avatar
1 vote
1 answer
183 views

Understanding Practical Differences Between ElGamal and Diffie-Hellman

I've been tasked with building a Web Assembly site that implements E2EE. I was thinking of using ElGamal Encryption to encrypt the message and Diffie-Hellman to establish the key. After doing further ...
  • 11
2 votes
1 answer
321 views

How can we link AES with Elliptic Curve Diffie-Hellman Key Exchange Method

Actually, I am working on a project to combine symmetric and asymmetric cryptographic algorithms. The shared secret key for AES will be generated through the Elliptic Curve Diffie Hellman Key Exchange ...
0 votes
0 answers
113 views

Can the same public key be used for ECDH and ECDSA [duplicate]

I want to generate a public key that I can use to sign messages and receive messages (using ECDH for exemple). I want to do so to have the smallest payload to share. Is it possible and proved secure ?
1 vote
1 answer
85 views

X3DH and key exchange between Alice identity key and Bob pre signed key (DH1)

I'm getting familiar with Signal key exchange phase and as far as I understand all 3 exchanges between Alice ephemeral key and all of Bob keys from the bundle, I have some thoughts about key exchange ...
2 votes
1 answer
217 views

Digital signature with Big Brother

I have read digital signature with Big Brother but don't understand the sequence. One approach to digital signatures is to have a central authority that knows everything and whom everyone trusts, say ...
1 vote
1 answer
155 views

Read ECDHE traffic with Wireshark or the like

There is some https traffic from a specific server (which I have the certificate and private key) that I need legitimately be able to read. This traffic doesn’t come via browser so besides the ...
1 vote
0 answers
49 views

Find a prime $p$ vulnerable to pohlig-Hellman

I need to find a prime number $p$ with the following constraints: $p$ is at least $1000$ bits long $p-1$ is a smooth number with the largest factor below $1000$ any factor of $p-1$ can be present ...
  • 11
1 vote
2 answers
149 views

Knowledge proof of private keys from DH key exchange

Given a group where the computational Diffie–Hellman (DH) assumption holds and generator G. Say there is a set of private randomly selected keys {a, b, c, d, e,...} and corresponding public keys set {...
1 vote
0 answers
90 views

CDH in a group of square matrices

This paper says the CDH problem in a group of square matrices can be solved by a generalized Chinese remainder theorem. I wonder how this problem might be solved? DH protocol in the cyclic group of ...
3 votes
1 answer
132 views

Is it safe to reveal an arbitrary EC point multiplied by a secret key?

We have a primary-order EC group. Need to perform a (sort-of) DH protocol, whereas the key is permanent, not a nonce (single-usage ephemeral key). So we receive an arbitrary group element (EC point) ...
  • 309
3 votes
1 answer
99 views

Strong Diffie Hellman in bilinear groups

The $n$-strong Diffie Hellman assumption state that given the subset $\{g, g^s,\cdots,g^{s^n}\} \subseteq \mathbb{G}$ in a cyclic group $\mathbb{G}$ of prime order $p$, a PPT algorithm cannot output $...
0 votes
0 answers
58 views

Does breaking CDH also break DLP? [duplicate]

Does breaking the computational Diffie-Hellman problem in a group also always break discrete logarithms in that group?
  • 217
2 votes
1 answer
164 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
  • 121
1 vote
1 answer
164 views

How to choose the appropriate Smoothness Bound while using the Index Calculus method

While implementing the Quadratic Sieve, the textbooks give a rough formula for what Smoothness bound you should use in your Factor Base. To factor a number N using the Quadratic Sieve, we can use the ...
  • 1,825
2 votes
1 answer
140 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
  • 1,447
1 vote
2 answers
129 views

Verifying result of (EC-)Diffie-Hellman

I received a public key by JSON. For the example, I have 4 keys: 2 public keys and 2 private keys. ...
  • 119

1
2
3 4 5
20