Questions tagged [diffie-hellman]

The Diffie–Hellman key agreement is an anonymous, non-authenticated key-agreement protocol.

Filter by
Sorted by
Tagged with
1 vote
2 answers
239 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
  • 335
3 votes
1 answer
629 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
0 votes
0 answers
172 views

Finding the private key in Diffie-Hellman

How do I go about finding the shared private key g^ab, if I know the prime p, primitive root g, and the public keys g^a and g^b? Assuming that a, b, p and g are all very large numbers (~50 digits), it ...
0 votes
2 answers
465 views

Diffie-Hellman key generation

We all see X509 certificates with 2048/4096-bit RSA key pairs; however, it is difficult to understand how they work in the DH part of the TLS handshake. At most, they authenticate and sign. DH 4096-...
  • 35
1 vote
1 answer
167 views

Modified ECIES using EC point ADD with DH key

I have questions about ECIES. ECIES Vanillia ECIES Encryption side (Alice's side) In "vanilla" ECIES when Alice wants to send Bob an encrypted message: Alice uses some Elliptic Curve, e.g. <...
  • 151
1 vote
0 answers
36 views

what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group. $H: \{0,1\}^*\rightarrow \{...
  • 413
1 vote
0 answers
49 views

How hard will it be to solve an equation in elliptic curve group/ cyclic group where Discrete Logarithm is hard?

Given an Elliptic curve group $E(\mathbb{F}_q)$ where the Discrete Logarithm Problem (DLP) is hard and a base point $G \in E(\mathbb{F}_q)$ with large prime order $n$, what will be the advantage of a ...
  • 413
0 votes
0 answers
13 views

SSH - Diffie-Hellman; prime & g exchange [duplicate]

The Diffie-Hellman key exchange algorithm can be used with SSH. But how does SSH exchange the large safe prime p and the ...
2 votes
1 answer
446 views

Static vs ephemeral diffie-hellman

I feverishly searched the web and couldn't find a clear explanation about what exactly is "Ephemeral diffie-hellman". Let's briefly recall how diffie-hellman basically works: Bob and Alice ...
  • 149
0 votes
0 answers
226 views

Is it more secure to use Diffie-Hellman to generate a symmetric AES key for use with CBC, rather than use CBC directly atop RSA encryption?

Short question: If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security ...
  • 113
1 vote
0 answers
368 views

How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?

I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key ...
  • 111
0 votes
1 answer
117 views

Can we do Multi-Prime Diffie-Hellman?

What is the correct way, if any, to do Multi-Prime DH? From security point of view, is there any benefit to do it? Multi-Prime is not about multi participants. Multi prime is when we use two or more ...
2 votes
1 answer
323 views

How is a generator found for a group, both in case of DH & ECDH?

First step in DH & ECDH is to choose a random prime $p$. Then you choose a generator $g$ for the group $\mathbb Z_p^*$. How do you find a generator? Likewise in ECDH, you would need to find a ...
  • 1,823
2 votes
1 answer
224 views

Inverse function of RSA and safe prime requirement of DH Key exchange

Ok so the inverse function of RSA encryption (that is decryption) is $ m \gets c^{d}\bmod N$ where $d$ is the secret exponent As I understand the hardness of RSA depends on two things: the Integer ...
0 votes
0 answers
62 views

What are the rules regarding to numbers in RSA?

I'd like to have a small sanity check first: As far as I understand, diffie-hellman is all about that fact that, given the generator ($g$), the modulo ($n$) and the remainder ($c$), it's hard to find ...
  • 149
1 vote
1 answer
108 views

Does this describe an invalid key share attack?

I recently came across a mention of invalid key share attacks on this site. It is done with DH groups over $\mathbb{ℤ}_p$ :prime $p$, where $p = qh + 1$, where $q$ is the prime order of DH subgroup ...
2 votes
1 answer
146 views

Proof of the Diffie-Hellman Key Exchange

Could someone please provide the math proof; $$ ((g^a)\bmod p)^b \bmod p = ((g^b)\bmod p)^a \bmod p $$
  • 41
9 votes
1 answer
701 views

Curve25519 Key Validation

According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from? Is there any proof ...
  • 277
3 votes
3 answers
574 views

What is the need for Diffie-Hellman key exchange when we have asymmetric encryption?

I am new to cryptography and I am having a hard time understanding what is the need for DHKE procedure. I think I fully understand the principle in which it happens and also the mathematics behind it ...
  • 133
8 votes
3 answers
2k views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
1 vote
1 answer
99 views

Computing $g^y\bmod p$ from $g^{y^2}\bmod p$ if Diffie-Hellman is compromised?

Given generator $g$ of a multiplicative group mod a prime $p$ the Diffie Hellman problem is to find $$g^{xy}\bmod p$$ from $g^x\bmod p$ and $g^y\bmod p$. The best way to solve this is through discrete ...
  • 882
1 vote
2 answers
107 views

Can $y^2=x^3-x+1$ elliptic curve with $GF(3^m)$ where $m=97$ be used for Diffie Hellman key exchange?

I am new to ECC. I have just read about the elliptic curve $y^2=x^3-x+1$. I am copying the exact line The elliptic curve is super-singular $E:y^2=x^3-x+1$ in affine coordinates defined over a Galois ...
  • 37
12 votes
0 answers
533 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
  • 44.2k
1 vote
1 answer
377 views

ECDH/ECDSA key exchange on embedded devices

Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to ...
  • 165
1 vote
1 answer
125 views

Are different elliptic curves compatible?

Regarding SubtleCrypto and curves P-256, P-384 and P-521. Can I mix two different curves for key derivation? For example performing key derivation between P-256 and P-521. EDIT: Can I mix two ...
  • 21
0 votes
0 answers
92 views

A card game (for mental poker or any other card game)

I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a ...
1 vote
2 answers
295 views

How to get the order of a group generator in DH?

For a DH parameter prime, if the generator $g$ is 2, how do I get the order $q$?
0 votes
1 answer
78 views

Diffie-Hellman Key Exchange

I apologize if this is in the wrong section. I am completely new to Cryptography. I was presented with the following problem and I am trying to find something that will explain to me how to proceed. ...
  • 1
4 votes
2 answers
348 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
  • 423
7 votes
1 answer
625 views

Why do the discriminant and primality of the group order of an elliptic curve affect security?

In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements. The ...
  • 383
1 vote
1 answer
155 views

ECDH - when are the domain parameters shared and how?

I'm trying to understand Diffie–Hellman based on Elliptic-curves. Can one explain at which point of time the domain parameters are shared? Are they shared trough a public channel and can they be ...
  • 39
2 votes
1 answer
175 views

Why is a random component needed for ECDH key pair generation in Mbed TLS?

Please forgive me if this is not the right place, however, I encountered this TLS implementation with a function that generates an ECDH key pair on an elliptic curve: In addition to the private key ...
10 votes
2 answers
991 views

What is a "constant time" work around when dealing with the point at infinity for prime curves?

I've been working for some time, on designing a constant time solution for dealing with the "point at infinity" for prime curves. So, far I'm using the Standard Projective Coordinates for ...
6 votes
2 answers
346 views

Is this variant of Diffie-Hellman viable and quantum resilient?

In this paper the author suggests using a variant of Diffie-Hellman which involves floating-point numbers of arbitrary size in the generation of a shared secret. There are no primes, calculations are ...
  • 1,423
9 votes
1 answer
877 views

ECIES vs. RSA + AES

I am confused about the distinction between RSA and ECC (Elliptic curve) regarding encryption and would appreciate it if someone could confirm whether my understanding is correct. To encrypt a large ...
  • 489
2 votes
1 answer
165 views

How does $g^{x^2} \bmod p$ help you find $x$?

I was thinking about the Diffie-Hellman key exchange. One fact that we seem to know is that given a group generator $g$, a prime $p$ and the expression $g^x \bmod p$ its believed to be hard to find $x$...
1 vote
1 answer
182 views

Solving Diffie-Hellman vs DLP

I'm wondering what is the current knowledge regarding the difficulty of solving the Diffie-Hellman problem (DHP). Obvisously solving the DLP (discrete log) is at least as hard as solving the DH ...
  • 121
10 votes
2 answers
2k views

Why is this not a viable key exchange algorithm? [duplicate]

I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys: Alice decides on a key she wishes to share with Bob. Alice generates a stream of bytes ...
  • 109
3 votes
0 answers
117 views

Strong Diffie-Hellman Problem

While reading the following paper about the Strong Diffie-Hellman Problem, i got curious about ways to compute $ g^{x^{l}} $ for unknown $x$ in an elliptic curve, without first solving the discrete ...
  • 31
1 vote
3 answers
362 views

Where is Challenge/Response and Certifcate Verification in TLS-DHE

We have been give a task to identify the following three components in TLS-DHE: Diffie Hellman Key Exchange I am fairly certain that this Part can be found in the Exchange of SKE and CKE, since they ...
1 vote
1 answer
89 views

How long to reestablish PKI if Diffie Hellman and Factoring are in classical $P$?

Supposing there is a classical (no need quantum) $O(\log N)$ algorithm to factor integers $N$ and supposing there is a classical (no need quantum) $O(\log p)$ algorithm to find $g^{xy}$ given $g^x$ ...
  • 882
0 votes
0 answers
93 views

What one-way functions are there based on the Diffie-Hellman problem?

Mathematical hardness assumptions like that of the factoring problem, the RSA problem, and the discrete log problem all straightforwardly lead to one-way functions. But what about the computational ...
3 votes
1 answer
83 views

Boneh DDH Paper - Sampling Integers in Random Reduction

I've been reading Dan Boneh's DDH paper, in particular section 3.1 which covers DDH randomized reduction. The first two sentences of theorem 3.1 state: Let $\Bbb G = \{G_p\}$ be a family of finite ...
  • 31
0 votes
1 answer
184 views

Elgamal Encryption: Why does Bob get to reuse his keypair while Alice has to generate a new one for every message?

From Christof Paar's book The protocol consists of two phases, the classical DHKE (Steps a–f) which is followed by the message encryption and decryption (Steps g and h, respectively). Bob computes ...
  • 1,823
2 votes
1 answer
115 views

Questions about Symmetric Encryption part of TLS

In TLS, we use DHKE for establishing the session key & then encrypt the actual communication with session key using symmetric encryption. While reading about DHKE, I learnt that you could use the ...
  • 1,823
1 vote
0 answers
57 views

Will a list of all prime numbers upto certain number of bits compromise crytopgraphic algorithms based on prime factorization? [duplicate]

I understand that many cryptographic algorithms depend on the difficulty of large prime factorization. Will a list of all prime numbers upto certain number of bits make it easy for an attacker to ...
3 votes
2 answers
564 views

If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?

There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams ...
  • 139
1 vote
2 answers
136 views

What are the consequences of Diffie Hellman problem in P?

Computational Diffie Hellman problem wants to know $g^{ab}$ given $g^a$, $g^b$ and $g$ while the discrete logarithm problem wants to know $x$ from $g^x$ and $g$. The latter resolvable in polynomial-...
  • 882
1 vote
1 answer
72 views

DH: Is it possible to solve for A private if all other variables are known with 90-bit modulus

$g^{ab} \pmod{p} = B^a \pmod{p}$ where all variables are known except $a$. In this case, I have an equivalent value for $a'*b'$, but this is not the same as the real values of $a*b$ due to the modulus....
2 votes
1 answer
165 views

Diffie Hellman groups

I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group. To be DHKE group, there are five ...

1 2 3
4
5
20