Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
3 votes
1 answer
139 views

Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information

Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
1 vote
0 answers
48 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
  • 41
3 votes
0 answers
57 views

Decisional Diffie-Hellman Assumption on Pairing Friendly Curves

It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH ...
  • 57
1 vote
1 answer
62 views

CDH solver algorithm construction

If $A$ is an efficient algorithm that solves the Computational Diffie-Hellman problem for $\frac{1}{2}$ of the inputs and returns a special symbol for the rest, how can I use $A$ to construct another ...
1 vote
0 answers
47 views

Diffie-Hellman Assumption

I'm wondering if the following problem is as hard as computational or decision Diffie-Hellman problem? (Or is it actually an easy problem because $c$ is available?) Given a cyclic group $G$ and let ...
  • 57
2 votes
1 answer
64 views

Why is ECDHE safe when paired within signing?

I wanted several videos by Computerphile on Elliptic Curve Diffie-Hellman, digital signatures and TLS. For the most part I understand everything but something is bothering me. Computerphile made a ...
3 votes
0 answers
118 views

Decisional Diffie-Hellman Assumption over Group of Quadratic Residue

Consider the Decision Diffie-Hellman (DDH) over $QR_n$ (the quadratic residue group over $n=pq$ where $p$ and $q$ are safe primes).According to Boneh's paper, DDH should be hard over $QR_n$ (https://...
  • 57
1 vote
1 answer
114 views

Linking Decisional Diffie-Hellman, Discrete Logarithm, and Knowledge of Exponent Assumptions

I'm curious about the relation between the Discrete Logarithm and Decisional Diffie-Hellman. Is it safe to have an assumption like the following to link the two? Given uniformly and independently ...
  • 57
1 vote
1 answer
46 views

Where are the seeds for the initial key exchange phase taken from?

I know that the standard DH and ECDH key exchange algorithms require the client and server to agree on a large prime number and a generator (in the DH algorithm) or a curve and a point (in the ECDH ...
2 votes
1 answer
183 views

How do I validate Curve448 public keys?

Performing an ECDH calculation with an invalid public key can leak information about your own private key. With Weierstrass curves, it's important to verify that the peer's public key is actually a ...
0 votes
1 answer
114 views

Authentication Fold-In in Oracle Database

The Oracle database has a feature known as "Native Network Encryption". It is a protocol described as a 4-step procedure. Step 1 : Negotiate parameters for following steps Step 2 : Exchange ...
's user avatar
2 votes
1 answer
175 views

Signal protocol: X3DH

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, <...
  • 121
2 votes
1 answer
197 views

Gap between DLog and CDH

Is there any concrete group in which one CDH is exponentially easier (even it's still hard) than DLog.
  • 2,191
2 votes
0 answers
38 views

Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
1 vote
1 answer
281 views

Why is DH key exchange still useful, if a public key certificate is used?

EDIT: According to Gilles's comments and fgrieu's answer below, I would like to summarize what I have learned, and what's still needs explanation: DHKE is necessary for forward secrecy even when PKI ...
  • 137
0 votes
1 answer
326 views

Method to mitigate MitM attack for DH key exchange

Plain DH key exchange protocol is vulnerable to MitM attack. I checked the SRP (RFC 2945) but did not fully understand why it can help. I thought of a fix to mitigate MitM problem by using a pre-...
  • 137
2 votes
1 answer
297 views

What is the role of SHA-1 on Diffie-Hellman-group1-SHA1?

I undersntand that in Diffie Hellman each party generates a public / private key pair and distributes the public key. I know that a combined key is created with the sender private key, and the ...
0 votes
2 answers
204 views

Advantage of Curve25519 (Elliptic Curve - Diffie Hellman)? [closed]

Is there any known vulnerability or attacks against Curve25519 ?? And pros and cons of using it?
1 vote
1 answer
94 views

RSA vs diffie-hellman + polyalphabetic cipher

My basic question is: How does RSA compare to using Diffie-Hellman + <some symmetric key crypto, e.g. a polyalphabetic cipher> Let's assume that factoring large numbers and computing discrete ...
  • 111
2 votes
2 answers
102 views

Super basic questions to DLP and DH

This is a super basic cryptography and I don't get it. My professor only explained it to us on a very abstract level, which I just agreed to without questioning it. The DLP says it is easy to ...
0 votes
0 answers
40 views

Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
1 vote
0 answers
81 views

How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
2 votes
2 answers
143 views

Does the diffie helman rachet in double ratchet do anything if one side never replies?

I am a little confused on how this functions so apologies in advance if the question is naive. The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is ...
  • 45
7 votes
2 answers
218 views

Is there a complete summarized list of attacks on Diffie-Hellman?

Is there a complete summarized list of attacks on Diffie-Hellman? For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
2 votes
1 answer
266 views

How to factorize the group order in Pohlig-Hellman algorithm

The Pohlig-Hellman algorithm is for computing discrete logarithms in a group whose order is a smooth integer. This algorithm requires the factorization of the group order. However we know that ...
2 votes
1 answer
217 views

Derive one public key from ECDH when the other and and the shared secret is known

Suppose we have an elliptic curve Diffie-Hellman key exchange protocol, where Bob and Alice have public keys $pk_{Alice}= [sk_{Alice}]G$ and $pk_{Bob}= [sk_{Bob}]G$ ($[.]$ elliptic curve "...
  • 23
0 votes
1 answer
87 views

When do we redo the Diffie-Hellman Exchange?

I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages. If one party is offline, but the other isn't, what ...
  • 1
0 votes
2 answers
511 views

DHKE Square and Multiply

Given is a DHKE algorithm. The modulus 𝑝 has 1024 bit and 𝛼 is a generator of a subgroup where 𝑜𝑟𝑑(𝛼)≈2160. Assuming the public keys have already been computed, how many number of modular ...
1 vote
1 answer
154 views

PIN-based authentication with Diffie-Hellman modular arithmetic

Given $\text{server}_\text{pub}= ((2^\text{largerandom}\bmod P) \cdot (2^{\operatorname{intvalueof}(“XXXX”)} \bmod P)^\text{pin})\bmod P$ We know the $\text{server}_\text{pub}$ and we know that $\text{...
0 votes
0 answers
85 views

Comparing Diffie Hellman and EC Diffie Hellman sizes

So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the ...
0 votes
0 answers
91 views

Can you obtain private key d and compute plaintext from El-Gamal?

Given an Elgamal encryption scheme with public parameters $k_{pub}=(p,\alpha,\beta)$ and an unknown private key $k_{pr}=d$. Due to an erroneous implementation of the random number generator of the ...
1 vote
1 answer
100 views

Diffie Helman obtaining $g^y \bmod p$ from $g^{xy} \bmod p$ and $g^x \bmod p$

This may seem like a strange question. Lets say I have $g^x \bmod p$ and $g^{xy} \bmod p$. How can I efficiently obtain $g^y \bmod p$? I assume I must use modular inverse but I don't know where.
2 votes
1 answer
139 views

What does DH(IPKa, IPKb) notation mean? Diffie-Hellman confusion

I'm trying to implement X3DH (extended triple Diffie-Hellman) in a network of mine. The way I understand it, a bundle (IPKb,SPKb,OTKb) is retrieved by Alice from Bob, through the server, and using her ...
  • 45
1 vote
1 answer
121 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
0 votes
1 answer
110 views

Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?

In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is ...
1 vote
1 answer
139 views

ElGamal Encryption over a Subgroup

Say for instance we are encrypting over a subgroup of ($Z_{67}^*, \bmod 67$). To perform a round of El Gamal's encryption scheme we should: Choose a subgroup of ($Z_{67}^*, \bmod 67$), of prime order....
4 votes
5 answers
4k views

Why do we use groups, rings and fields in cryptography?

I'm a student of Masters in Cyber Security. I have a habit to understand things from their first principles (at the very beginning). Kindly use any simple mathematical example to answer because I have ...
  • 57
2 votes
3 answers
136 views

Diffie-Hellman computing public key with a large private key

Given is Generator $g = 5$, Multiplicative group $F_{10007}^*$, Private key = 7347. Then public key is $5^{7347} \bmod 10007$ right? On a calculator this gives an overflow error, how am I supposed to ...
  • 143
0 votes
1 answer
59 views

Is this an instance of a Diffie-Hellman problem?

Let $\mathbb{G}$ be a cyclic group of order $p$ with generator $g$, and let $m\in\mathbb{G}$. Problem: Given $c=m.g^{k.a}$ and $v=g^a$, where $k,a \in \mathbb{Z}^*_p$, output $k$. Is this an instance ...
  • 413
1 vote
1 answer
65 views

Server authentication in TLS 1.2 with static DH

For (EC)DHE cipher suites, server authenticates itself by proving the possession of the private key matching its certificate by signing ServerKeyExchange message (...
-1 votes
1 answer
69 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...
1 vote
0 answers
72 views

How does TLS 1.3 sign key exchange?

From this site: https://tls13.ulfheim.net/ and from https://www.rfc-editor.org/rfc/rfc8446#section-2 I can't find the part in which the exchange of keys is signed, isn't one of the parties "...
  • 11
1 vote
1 answer
119 views

Is there any standard present to measure strength of a generated key using true random number generator?

I was wondering how to measure the security strength of a generated secret key for the below protocol: "A 128 bit random number is generated by TRNG and the random number will be used as a ...
  • 37
-2 votes
1 answer
189 views

Finding Diffie-Hellman secret key with only some know values [closed]

I currently have the following information and I assume the first line separated by the: represents the prime number and generator. Is there any way I can find the secret key shared for the Diffie-...
2 votes
1 answer
136 views

Tamarin-prover Issue on a Basic Diffie-Hellman Exchange

I am starting Tamarin prover, and it is hard to understand. Here is a basic example of my issue: First Code : ...
  • 21
0 votes
0 answers
79 views

Proof of knowledge of discrete log

Suppose that $P = pG = H(rK)G$, where $P$ is a point on an elliptic curve, $H$ is a hash function, $rK = kR$ is a shared secret between the party that knows $r$ and the party that knows $k$, and $G$ ...
  • 515
2 votes
1 answer
433 views

What can we recover with an invalid curve attack

According to the "Guide to Elliptic Curve Cryptography" (page 182), it's possible to recover $d$ with an invalid curve attack. How can this value be used once recovered? For example, with ...
  • 47
2 votes
2 answers
238 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
  • 86.5k
1 vote
1 answer
190 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
  • 13
4 votes
1 answer
148 views

Weak Decisional Diffie-Hellman Problem

Is this problem still hard? Given $$(g,g^a,g^b,c)$$ decide if $c=a\cdot b$? If there is an adversary that solves the standard Decisional Diffie-Hellman Problem then it can solve my new problem. But I ...

1 2
3
4 5
20