Skip to main content

Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
1 vote
1 answer
158 views

Encrypt messages for two-participants chat

I need a chat between two users and I obviously want to make it as secure as possible. I am, by no means, a cryptography expert, so I turn to you guys for some advice. Because I like the idea of ...
SparxDev's user avatar
0 votes
0 answers
110 views

Finding $a$ in $g^a\bmod p$ in Diffie-Hellman [duplicate]

This might be a silly question but I am unable to wrap my mind around it. In Diffie-Hellman can we find $a$ when $A = g^a\bmod p$, given we know $A$, $g$ and $p$?
user avatar
2 votes
1 answer
131 views

How does this libgcrypt elgamal decryption work?

Update: The question below was asked before I realized that this is being done to prevent a side channel attack: https://github.com/advisories/GHSA-5p8v-2xvp-pwmc What I am still curious about, is the ...
Derek's user avatar
  • 155
0 votes
1 answer
288 views

Trying out the small subgroup attack on a group of non-prime order using a simple additive group instead of an Elliptic Curve Group?

This is the attack I am talking about - Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? An elliptic curve group of order $8p$ where $p$ is a prime. Let $G$ be the ...
user93353's user avatar
  • 2,245
0 votes
2 answers
2k views

In a Diffie-Hellman key exchange Find this key and compute the shared secret key k

Hi I struggling to find the answer of my schhol exam, can anyone help me . In a Diffie-Hellman key exchange the multiplicative group of integers modulo p is used with the parameters p = 59, g = 3 mod ...
Yen's user avatar
  • 3
3 votes
2 answers
115 views

Commutable and Composable Asymmetric Encryption/Decryption

I have a need for the following encryption properties: $f(g(v_\text{plaintext}) = v_\text{ciphertext}$ needs to be decryptable by $f^{-1}(g^{-1}(v_\text{ciphertext}))$ and $f$ and $g$ need to be ...
fuzzybear3965's user avatar
4 votes
1 answer
592 views

Understanding the small cofactor attack with Elliptic Curves of non-prime order

I came across 2 older answers (2 different but similar questions on the small cofactor attack) which cover this attack. https://crypto.stackexchange.com/a/12614/3941 Here the attacker replaces the $...
user93353's user avatar
  • 2,245
1 vote
1 answer
431 views

Diffie-Hellman over $GF(2^{128})$

Can I use Diffie-Hellman over, say, $GF(2^{128}) \bmod$ irreducible poly in $GF(2^{128})$ instead of $GF(p)$? If not, why? Or increase it to $GF(2^{2^{\text{whatever}}})$.
Arthur Strong's user avatar
1 vote
1 answer
1k views

How is Diffie-Hellman linked to AES?

I have just learnt about Diffie-Hellman and AES. However, I cannot seem to understand how they link. My initial idea was that Diffie-hellman is used to transfer a key for AES decryption. After further ...
abzzer's user avatar
  • 13
2 votes
2 answers
410 views

ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
ThomasPaper's user avatar
2 votes
1 answer
2k views

Where is the definition of one-way trap-door function used in public key cryptography

This is a rather simple question but I've been unable to find a proper answer for this online. When defining an asymmetric (public key) algorithm is the one-way trap-door function usage referring to ...
Crypto Newbie's user avatar
2 votes
2 answers
482 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
Kibnakamoto's user avatar
1 vote
0 answers
163 views

Are real-or-random model and LR-model are equivalent?

Are real-or-random(rr) model and LR-model are equivalent? In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent. Here is ...
Lee Seungwoo's user avatar
0 votes
1 answer
244 views

How is the shared secret generated in IPsec using DH key generation?

I have doubt like when in the IPsec we use a DH group for key exchange. It takes a prime number and $g$ value from group bit. How does the key exchange payload and nonce help to generate the shared ...
Ruchi's user avatar
  • 1
0 votes
1 answer
73 views

How SSL (similar version) works?

My book suggested the following protocol to replace SSL: A lot of the terms are familiar to me from the Original SSL, like ChangeCipherSpec message which means ...
Omer's user avatar
  • 5
-1 votes
1 answer
114 views

The benefit of the shared key generated from ECDH key exchange protocol [duplicate]

What the benefit of the shared key that generated from ECDH key exchange protocol? Can I use it to encrypt the message or encrypt the public key of asymmetric encryption?
amal albilali's user avatar
0 votes
0 answers
122 views

How to reduce Diffie Hellman problem to ElGamal?

I'm trying to answer without success questions (ii - iv) Any hint will be appreciated :)
Facundo Fleitas's user avatar
0 votes
0 answers
63 views

Looking for multi-party key exchange/shared secret algorithm with specific requirements

I'm looking for the ability to create a SINGLE CONSTANT shared secret amongst two or more users (a group) AND if a new user is added to such a secured group the new user should also be able to learn ...
RobbB's user avatar
  • 189
0 votes
2 answers
79 views

What E means in Diffie Hellman protocol?

I was looking for an example of protocol to verify user's identity using Diffie Hellman which works like this: client sends: $g^x$, ...
Omer's user avatar
  • 5
0 votes
2 answers
340 views

Why do we need to use Asymmetric cryptography if Diffie-Hellman solves the key exchange problem of symmetric cryptography?

I am new to cryptography and I cant get my head around this issue: If symmetric cryptography is faster then asymmetric and given that Diffie-Hellman key exchange algorithm allows you to exchange keys ...
ezio's user avatar
  • 157
1 vote
0 answers
238 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
Fan Zhang's user avatar
1 vote
1 answer
519 views

Sending encrypted message without public key from recipient (elgamal)

assume Bob and Alice use Elgamal encryption scheme. Alice wants to send Bob a message, but does not know Bobs public key. Is there a way for Alice to find out Bobs public key by receiving multiple ...
Reideler's user avatar
1 vote
2 answers
404 views

Can a MITM during Diffie-Hellman key exchange manipulate both sides to generate symmetric secrets?

Is it possible for an attacker on a Diffie-Hellman key exchange to manipulate both sides in a way so that the secret generated on each side is identical? Or put differently, would it be possible to ...
smatt's user avatar
  • 13
2 votes
1 answer
207 views

Could anyone explain what Two Oracle Diffie-Hellman assumption is?

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already ...
user900476's user avatar
0 votes
1 answer
161 views

What's the meaning of asterisk and PPT in this paper?

I'm very new to cryptography. I'm required to read a paper. I totally don't understand. First, what's the meaning of the asterisk in $H:\{0,1\}^*\rightarrow \{0,1\}^k ?$. Second, what does PPT mean ...
user900476's user avatar
0 votes
1 answer
443 views

IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results I've run ...
Mick8695's user avatar
  • 111
1 vote
1 answer
168 views

Can Bob and Alice do an authenticated Diffie–Hellman key exchange if Bob only knows the hashsum of Alice's key?

Tor vanilla bridges look like this: Bridge x.x.x.x:1234 9DD03662B50FEDBF6F8D5630CB86D7E8CE4F4432 It's only the IP/Port and a hash of the key. Can Bob and Alice do an authenticated Diffie–Hellman key ...
phantomcraft's user avatar
2 votes
1 answer
90 views

Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

Let's suppose that Bob has only Alice's IP and no more information about Alice's key, nor the digest of Alice's key. They exchange keys and need proof that the received keys are the same keys that ...
phantomcraft's user avatar
1 vote
1 answer
180 views

Tree Parity Machines (neural cryptography) advantages

It seems that neural cryptography is an interesting research topic and there are some important contributions published in the last years. The proposed algorithms are suitable for symmetric key ...
Pietro's user avatar
  • 13
0 votes
1 answer
984 views

64 bit key size Diffie Hellman

I am building a cryptographic El Gamal implementation on the Cardano Blockchain for a poker game. Each hand the players generate a DH 64 bit keys and shuffle the cards together via homomorphic ...
Fermat's user avatar
  • 101
1 vote
1 answer
71 views

How do I ascertain the key length of some Diffie Hellman moduli to counteract the Log Jam vulnerability?

I have the following Diffie-Hellman ciphers on one of my servers ...
Mick8695's user avatar
  • 111
1 vote
1 answer
178 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
Andy's user avatar
  • 71
1 vote
1 answer
57 views

Division by $2$ or principal root with DH oracle

Assume $g$ is generator of multiplicative group modulo prime $p=2q+1$ where $q$ is prime. Assume we know $g^{2t}\bmod p$ and $g^{2}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. ...
Turbo's user avatar
  • 930
2 votes
1 answer
195 views

Breaking CDH also breaks DHI

I am trying to show that by breaking the Computational Diffie-Hellmann (CDH) assumption one also breaks the Diffie-Hellmann inverse assumption. Unfortunately, I am a bit stuck and do not know where to ...
Rory's user avatar
  • 335
0 votes
1 answer
490 views

RSA Encryption and ECDH in OpenPGP

According to RFC4880 standard 1.Refer to section 2.1 Confidentiality via Encryption --> OpenPGP combines symmetric-key encryption and public-key encryption to provide confidentiality +To protect ...
Andy's user avatar
  • 71
0 votes
1 answer
37 views

Distributing the Master Public Key in Identity-based Encryption systems

I was just wondering how the private key generator should publish the master public key inside of an IBE system. This key is needed for all devices in the network to derive the public key of receiving ...
Alex Meyer's user avatar
0 votes
1 answer
139 views

What is the Diffie Hellman session key used for in IPsec protocol?

Let's say we choose AES as cryptographic algorithm for IPsec. My question is the following Is the key produced by Diffie-Hellman algorithm used as INPUT to the AES algorithm so AES does the ...
Historical Swimming's user avatar
3 votes
1 answer
473 views

Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
performancematters's user avatar
1 vote
2 answers
94 views

Is there a standardized way to evaluate the security of a key exchange algorithm?

I'm now trying to design a more secure key-change algorithm to replace widely used DH. However, I am only able to prove that my algorithm is more secure logically, which means I can only prove it from ...
Zim's user avatar
  • 41
1 vote
2 answers
49 views

Definition of Multilin DDH

I am on the abbreviation mutlin. DDH, which probably stands for mutliniear Decision Diffie Hellmann. I am currently looking for a definition for this term, but unfortunately cannot find a source. Can ...
Thomas's user avatar
  • 23
1 vote
2 answers
559 views

Definition of the strong Diffie Hellman problem

I am looking for the definition of the strong Diffie Hellmann problem. However, I can only find definitions for the $\ell$ or $q$-strong Diffie Hellmann. Is it possible that the strong Diffie Hellman ...
Thomas's user avatar
  • 23
1 vote
1 answer
690 views

What is ECDH used for in BLE Authentication?

I am currently new to the world of BLE and I came across this article which mentions ECDH. In the diagram in part $3$, it generates the DHKey/shared secret (I am assuming this is the correct ...
Belphegor's user avatar
  • 111
5 votes
2 answers
3k views

I don't see how a ECDH is useful

I'm having a hard time understanding the usefulness of using an ECDH over traditional asymmetric encryption. Both parties have to exchange public keys to compute the ECDH, so why wouldn't they just ...
M1Reeder's user avatar
  • 153
3 votes
2 answers
225 views

Common exponent problem related to discrete logarithms assuming Diffie Hellman oracle

Let $g$ be a generator of multiplicative group mod $p$ a prime. Suppose we know $$g^{a+km_1}\bmod p$$ $$g^{b-km_2}\bmod p$$ $$g^{a+k'm_3}\bmod p$$ $$g^{b-k'm_4}\bmod p$$ where $m_2m_3-m_4m_1=\phi(p)$ ...
Turbo's user avatar
  • 930
5 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
nilch's user avatar
  • 73
2 votes
1 answer
117 views

How small is the negligible advantage for DDH?

The well known Decisional Diffie Hellman assumption (DDH) assert that for any $n = \log q$ and generator $g$ of $\mathbb{Z}_q$, for uniformly i.i.d $A, B, C \sim U(\mathbb{Z}_q)$, the following are ...
Napoleon's user avatar
  • 113
1 vote
1 answer
144 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
crypto_beginner's user avatar
0 votes
1 answer
54 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8 in ACVP

Hi I found this question which I am currently struggling with. How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8? In ACVP, the input diffe-hellman shared secret ...
Fiona's user avatar
  • 1
1 vote
1 answer
174 views

On access to a Diffie Hellman oracle

Assume $g$ is generator of multiplicative group modulo prime $p$. Assume we know $g^X\bmod p$ and $g^{XY}\bmod p$ and assume we can have access to a Diffie-Hellman oracle. Can we find $g^Y\bmod p$ in ...
Turbo's user avatar
  • 930
0 votes
0 answers
122 views

Security of a variant of DDH

The standard DDH assumption states that given $(g,g^a,g^b,g^c)$, it is hard to determine whether $c$ is $ab$ or not. A variant of DDH assumption is: given $(g,g^a,g^b,g^c, g^{ab} ,g^{bc},g^{ac})$, it ...
filter hash's user avatar

1 2
3
4 5
22