# Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

987 questions
Filter by
Sorted by
Tagged with
139 views

### Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information

Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
1 vote
48 views

### Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
• 41
57 views

### Decisional Diffie-Hellman Assumption on Pairing Friendly Curves

It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH ...
• 57
1 vote
62 views

### CDH solver algorithm construction

If $A$ is an efficient algorithm that solves the Computational Diffie-Hellman problem for $\frac{1}{2}$ of the inputs and returns a special symbol for the rest, how can I use $A$ to construct another ...
1 vote
47 views

### Diffie-Hellman Assumption

I'm wondering if the following problem is as hard as computational or decision Diffie-Hellman problem? (Or is it actually an easy problem because $c$ is available?) Given a cyclic group $G$ and let ...
• 57
64 views

### Why is ECDHE safe when paired within signing?

I wanted several videos by Computerphile on Elliptic Curve Diffie-Hellman, digital signatures and TLS. For the most part I understand everything but something is bothering me. Computerphile made a ...
118 views

### Decisional Diffie-Hellman Assumption over Group of Quadratic Residue

Consider the Decision Diffie-Hellman (DDH) over $QR_n$ (the quadratic residue group over $n=pq$ where $p$ and $q$ are safe primes).According to Boneh's paper, DDH should be hard over $QR_n$ (https://...
• 57
1 vote
114 views

### Linking Decisional Diffie-Hellman, Discrete Logarithm, and Knowledge of Exponent Assumptions

I'm curious about the relation between the Discrete Logarithm and Decisional Diffie-Hellman. Is it safe to have an assumption like the following to link the two? Given uniformly and independently ...
• 57
1 vote
46 views

### Where are the seeds for the initial key exchange phase taken from?

I know that the standard DH and ECDH key exchange algorithms require the client and server to agree on a large prime number and a generator (in the DH algorithm) or a curve and a point (in the ECDH ...
183 views

### How do I validate Curve448 public keys?

Performing an ECDH calculation with an invalid public key can leak information about your own private key. With Weierstrass curves, it's important to verify that the peer's public key is actually a ...
114 views

### Authentication Fold-In in Oracle Database

The Oracle database has a feature known as "Native Network Encryption". It is a protocol described as a 4-step procedure. Step 1 : Negotiate parameters for following steps Step 2 : Exchange ... 175 views

### Signal protocol: X3DH

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, <...
• 121
197 views

### Gap between DLog and CDH

Is there any concrete group in which one CDH is exponentially easier (even it's still hard) than DLog.
• 2,191
38 views

### Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
1 vote
281 views

### Why is DH key exchange still useful, if a public key certificate is used?

EDIT: According to Gilles's comments and fgrieu's answer below, I would like to summarize what I have learned, and what's still needs explanation: DHKE is necessary for forward secrecy even when PKI ...
• 137
326 views

### Method to mitigate MitM attack for DH key exchange

Plain DH key exchange protocol is vulnerable to MitM attack. I checked the SRP (RFC 2945) but did not fully understand why it can help. I thought of a fix to mitigate MitM problem by using a pre-...
• 137
297 views

### What is the role of SHA-1 on Diffie-Hellman-group1-SHA1?

I undersntand that in Diffie Hellman each party generates a public / private key pair and distributes the public key. I know that a combined key is created with the sender private key, and the ...
• 31
204 views

### Advantage of Curve25519 (Elliptic Curve - Diffie Hellman)? [closed]

Is there any known vulnerability or attacks against Curve25519 ?? And pros and cons of using it?
1 vote
94 views

### RSA vs diffie-hellman + polyalphabetic cipher

My basic question is: How does RSA compare to using Diffie-Hellman + <some symmetric key crypto, e.g. a polyalphabetic cipher> Let's assume that factoring large numbers and computing discrete ...
• 111
102 views

### Super basic questions to DLP and DH

This is a super basic cryptography and I don't get it. My professor only explained it to us on a very abstract level, which I just agreed to without questioning it. The DLP says it is easy to ...
40 views

### Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
1 vote
81 views

### How to decrypt raw TLS bytes?

Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used? The closest I found is this. I know its possible using Wireshark, but ...
• 11
143 views

### Does the diffie helman rachet in double ratchet do anything if one side never replies?

I am a little confused on how this functions so apologies in advance if the question is naive. The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is ...
• 45
218 views

### Is there a complete summarized list of attacks on Diffie-Hellman?

Is there a complete summarized list of attacks on Diffie-Hellman? For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking ...
266 views

### How to factorize the group order in Pohlig-Hellman algorithm

The Pohlig-Hellman algorithm is for computing discrete logarithms in a group whose order is a smooth integer. This algorithm requires the factorization of the group order. However we know that ...
217 views

### Derive one public key from ECDH when the other and and the shared secret is known

Suppose we have an elliptic curve Diffie-Hellman key exchange protocol, where Bob and Alice have public keys $pk_{Alice}= [sk_{Alice}]G$ and $pk_{Bob}= [sk_{Bob}]G$ ($[.]$ elliptic curve "...
• 23
87 views

### When do we redo the Diffie-Hellman Exchange?

I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages. If one party is offline, but the other isn't, what ...
• 1