Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
0
votes
0answers
26 views
Decentralized / Distributed Private Key Generation between Untrusted Parties?
I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows:
"Decentralized private key generation – Multiple Enigma nodes ...
0
votes
0answers
25 views
How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]
In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
-1
votes
0answers
43 views
Is there any way of decrypt ciphers without sharing the key? [use case IoT] [on hold]
in symmetric cryptography, key sharing is a big issue. suppose in a IoT environment, the nodes will encrypt a message with the encryption key and receiver need that key to decrypt the message for ...
1
vote
1answer
31 views
Can I do a forward secure half-round ephemeral-static ECDH?
In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:
ECC key pairs for open ID
...
1
vote
0answers
56 views
If 1 can be a random number in Diffie-Hellman Algorithm
I've done some calculations and Diffie-Hellman Algorithm worked for all chosen random numbers except $1$. In the description of the algorithm, I can't find information that the random number has to be ...
1
vote
0answers
22 views
How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?
I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
1
vote
1answer
43 views
When do clients use TLS in PSK mode?
The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
3
votes
1answer
205 views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
1
vote
1answer
96 views
Key-Exchange in Steganography
I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the ...
7
votes
0answers
78 views
Differences between “NewHope” and “NewHope-simple”
The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
2
votes
0answers
32 views
Key confirmation and other benefits of double ratchet
I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting.
This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
3
votes
2answers
72 views
In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?
I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are.
The closest I've come to is ...
1
vote
1answer
42 views
Diffie-Hellman: Recommendation of the base size?
Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
0
votes
0answers
29 views
Two-party symmetric key establishment protocol
I need a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any ...
0
votes
1answer
71 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
1
vote
0answers
43 views
Reason for including the public key of the key agreement in the KDF
I found the following text when looking up KDFs:
In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter.
...
7
votes
3answers
242 views
Formal description of KDF1 and KDF2
I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
0
votes
1answer
44 views
Burmester Desmedt Key agreement. Is the division a floating point one or an integer one
As I look upon Burmester Desmedt algorithm:
I notice that the intermediate key $K_i$ is getting calculated as:
$K_i=(k_{i+1}/k_{i-1})^{x_i} \mod p$
Thus I wonder wheher the division $k_{i+1}/k_{i-1}...
1
vote
1answer
102 views
What happens if we choose the random secret keys in Diffie-Hellman greater than prime?
Diffie-Hellman works as follows:
Given public parameters $p$ (a large prime) and $g$ (always referred to as a generator of $(\mathbb{Z}^∗_p)$. Then:
Alice randomly chooses $a<p$ and sends $A\...
2
votes
1answer
54 views
Protocol that generates keys every 2 minutes using KDC
I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same
key, I want to renew the session keys ...
1
vote
1answer
57 views
Can you construct a key agreement system from public-key-encryption system?
Can you construct a key agreement system from public-key-encryption system? If so, how?
What about vice versa?
0
votes
0answers
36 views
Most energy-efficient authentication protocol?
I am looking for a cryptographic protocol that is as energy-efficient as possible. I am talking about battery drain. Alice wants to do a mutual authentication with Bob. Maybe symmetric is good, maybe ...
0
votes
0answers
31 views
Burmester Desmedt confused on the last step
I try to implement in code the traditional burmester desmedt algorithm for group key agreement:
But I have the following question regarding the last step:
$K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
1
vote
0answers
47 views
Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0
In the original mDP protocol once all $z$ values received from each participant the following calculation is being done:
If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then ...
0
votes
0answers
23 views
Which Auxiliary Hash Function to use for Pointcheval's mDP protocol
I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
0
votes
0answers
61 views
Sharing secret content with multiple recipients
I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email.
I am no expert in crypto ...
0
votes
0answers
50 views
Simple but secure method to share secret (128 bit AES key) though an untrusted relay
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
1
vote
0answers
63 views
Security of the Needham-Schroeder public key protocol after a minor adjustment
I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:
We have the Needham Schroeder Public Key Protocol:...
7
votes
2answers
530 views
Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?
By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN:
It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
0
votes
0answers
12 views
Production Ready Message Format Standart for Key agreements on top of XMPP
Greedings,
I try to run group key agreements on top of XMPP thus I want somehow a production used message format for key agreement. As far I found theese:
XEP-0384: OMEMO Encryption
XEP-0102
But all ...
3
votes
1answer
85 views
Is OAEP needed when encrypting a session (random) key using RSA?
My question is two parts:
when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
0
votes
2answers
86 views
Is it possible to get different plaintexts from a single ciphertext using different keys?
Suppose to have a chipertext that you can't decrypt, but you know that the plaintext can be A, B or C. Then arrives to you the key which is used to encrypt the chipertext.
You can decrypt the ...
6
votes
1answer
147 views
Why would the use of Curve25519 in Dragonfly leak information?
An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote:
One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
1
vote
1answer
294 views
How does Dragonfly key exchange work, in non-white-paper terms?
I'm trying to understand WPA3, whose Simultaneous Authentication of Equals is supposedly similar to Dragonfly Key Exchange.
Dragonfly is resistant to dictionary attacks, meaning that rather than an ...
1
vote
1answer
122 views
Why does DH-EKE require that public keys be indistinguishable from random?
The introduction to SPAKE pre-authentication states:
Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman ...
3
votes
1answer
126 views
In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?
According to KeyCDN, TLSv1.3 connections are established in a single round trip:
While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip
If ...
0
votes
1answer
36 views
Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages
Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the ...
1
vote
0answers
65 views
Simulatability of Diffie-Hellman Key Exchange
While reading through Shoup's paper on provably secure Diffie-Hellman key exchange (DHKE), I do not understand something rather simple.
There are two parties $A$ and $B$. $A$ starts by sending $g^a$, ...
2
votes
2answers
167 views
Curve25519 Key Exchange Bit Security
Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw.
Alice and Bob want to communicate securely over an insecure ...
6
votes
2answers
316 views
Do standalone Oblivious Transfer (OT) Protocols exist?
Are there any Oblivious Transfer (OT) protocols that don’t rely on asymmetrical encryption, public-key encryption or key-exchange?
I’m starting to wonder, as all the OT protocols I know of (and can ...
3
votes
1answer
95 views
How to handle a lost key in Diffie-Hellman Key Exchange
I implemented the Diffie-Hellman Key Exchange algorithm but, I was wondering how to handle if one of the parties lost his key.
Let's take a chat app as an example, Bob and Alice they used to have a ...
3
votes
1answer
146 views
Asynchronous Ratcheting Tree and modern group key agreements: Why left balanced-tres used?
Nowadays the group key agreements are based upon tree-based ones such as Asynchronous Ratcheting tree. Especially the latter one is constructed upon left-balanced tree.
So I keep wondering what ...
3
votes
1answer
73 views
Change a secret key in an embedded device
There is a device that uses a secret key Sk to encrypt data.
Assume this Sk is compromised.
Could the following scheme be considered safe, in case we want to change the compromised Sk:
We store some ...
1
vote
1answer
67 views
How to exchange a secret through untrusted server in two steps?
I have a web application where I control the server, however, it should not have any knowledge of secrets that are exchanged between its users. This server holds RSA public keys of each registered ...
1
vote
1answer
80 views
Publicly exchanging keys
my use case is the following: Sharing a secret on the blockchain from one participant over a smart-contracts with revealing the secret only after some condition is verified (another participant has ...
2
votes
2answers
89 views
Does the Server Key Exchange sign a hash or text
In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
2
votes
1answer
73 views
Why are computations (isogeny) in SIDH done in an extended prime field?
While reading the SIDH key exchange protocol, I noticed that all the isogeny computations and curves are defined over the extended prime field $\mathbb{F}_{p^2}$. Does it make the problem ...
1
vote
0answers
15 views
Asyncronous Rachet tree: How user movability is handled is the Rachet tree being recreated?
As I have read the latest state of art in group key agreement is the Asyncronous Rachet Tree.
But in applications like IRC that exists high user movability (users join in ans leave the room). Is ...
1
vote
1answer
118 views
How Elliptic-Curve affects the Server Key Exchange parameters
In Finite Field DHE, the server sends the following parameters in the server key exchange message:
$p$: prime
$g$: group
$g^b$: the server's public DH key
In DHE_RSA (non anonymous DHE), the server ...
2
votes
1answer
37 views
mDP kay agreement protocol where z's are found on the step where the common key is generated?
Whilst I was studying the mDP protocol I came across into the following step:
Group Key agreement:
Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\...
