Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
516
questions
2
votes
1answer
44 views
Significance of y-coordinates in ECDH public key exchange
In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019,
they talk about attacks in Bluetooth pairing, they state that in the ...
1
vote
0answers
20 views
Purpose of signing the signed prekey in X3DH?
I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
2
votes
0answers
37 views
Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?
While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
3
votes
1answer
69 views
Good key update algorithms for key evolving schemes
In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$.
What is a ...
2
votes
1answer
49 views
Why is this authenticated Diffie–Hellman key exchange insecure?
I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember
$$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$
$$B\to A: (B, g^...
2
votes
0answers
17 views
Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?
Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
1
vote
1answer
50 views
MQV protocol and man-in-middle attack
Why MQV is said to be an “authenticated Diffie-Hellman” protocol? The process in the picture shows nothing about authentication. Besides, a man-in-middle can impersonate B to negotiate with A, because ...
0
votes
0answers
13 views
Isogeny-based AKE: what is the difference between Gal 1 and FTTY 1?
What is the difference between
(a) the AKE scheme proposed by Galbraith (based on TS2 protocol) in https://eprint.iacr.org/2018/266.pdf (page 9-10); and
(b) the AKE scheme proposed by Fujioka et al. ...
4
votes
1answer
60 views
Can libsodium's X25519 encryption construction be generalized?
It is my understanding that libsodium's sealed_box is based on X25519, a Diffie-Hellman function: By combining the X25519 key agreement with a symmetric cipher and having a recipient derive the ...
1
vote
0answers
31 views
Server distributing/sharing a symmetric key to one or more clients via an established secure connection?
I have a server and a client device that share two separate data channels that each need to have authentication and encryption protections.
When a connection is made over data channel 1, it is secured ...
0
votes
1answer
26 views
Key Agreement between two nodes of a Wireless Sensor Network
Can there be a way to form a shared secret key between two nodes of a Wireless Sensor Network who are more than one hop away, simply on the basis of their IDs?
0
votes
0answers
31 views
Password-based chosen-basis computational Diffie-Hellman assumption
In Simple Password-Based Encrypted Key Exchange Protocols, the authors proposed a hard assumption as follows.
Experiment $Exp^{pccdh}_{\mathbb{G}, n}(\mathcal{A}, M, N, X^{'}, \mathcal{P})$
$(Y^{'}, ...
1
vote
0answers
31 views
Transcript collisions and hash collisions in (password) key exchange protocol
In New Security Results on Encrypted Key Exchange, there is a Game 2 as follows:
Game $G_{2}$: For an easier analysis in the following, we cancel games in which some (unlikely) collisions appear:
...
0
votes
2answers
114 views
How to encrypt with elliptic curve cryptography (ECC)?
I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works.
Why can't you ...
0
votes
0answers
20 views
Can we use HMQV in an asynchronous setting?
Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following:
$\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral ...
1
vote
0answers
62 views
is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
1
vote
1answer
50 views
Do all PAKE assume that all parties already have a password?
I was looking for a means to perform a key exchange without relying on a PKI. I discovered Password Authenticated Key Exchange (PAKE) and after reading J-PAKE; I have the following questions:
Do PAKE ...
0
votes
1answer
55 views
Diffie-Hellman Decryption with A, B, p, g, cipher Parameters
I have a Crypto assignment, trying different ideas for couple hours landed me nowhere.
Supposedly during a Diffie-Hellman key exchange Alice sends bob an encrypted message, the message (cipher) is a ...
0
votes
0answers
23 views
Are there any known problems performing a One-time pad with 2 keys stored separately - AKA 2 part Symmetric key exchange over TLS
If this is something that already has a name, please tell me to look at that, but I have not been able to find one yet.
I am considering this process for storing some data securely. I want to ...
0
votes
0answers
36 views
Is the password based key exchange secure even if the public key is known to adversary?
I am assuming the answer for part 1 to be a "NO" as the adversary knows the public key he can get the password by offline attack
IN part 2 : the answer is "yes" as the public key is freshly generated ...
0
votes
0answers
19 views
Why MQV scheme need a half coordinate?
Recently I get to know the MQV key agreement in a lecture.
the protocol is quite simple MQV
My question is why there is a $\hat X and$ $\hat Y$ in the protocol, it does not seem natural at all, does ...
0
votes
1answer
49 views
Possibility of Man-in-the-Middle on X3DH
I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is ...
0
votes
0answers
32 views
Diffie-Hellman Key Exchange - Key Derivation before Execution
I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
0
votes
1answer
79 views
What is the definition of dummy password?
Recently, I try to read some papers about Password Authenticated Key Exchange (PAKE). I can’t understand the meaning of “dummy password .” Can someone gives a concrete definition of it. And what is ...
0
votes
2answers
85 views
Random Oracle to prove an Authenticated DH protocol
I am trying to understand how they use the random oracle to solve the CDH. For example, in the security proof on page 7 of the following paper; A Lightweight Message Authentication Scheme for Smart ...
0
votes
1answer
62 views
Looking for feedback on the cryptographic design of my open source project: Bloom [closed]
I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption.
I've published the cryptographic details ...
1
vote
0answers
78 views
What is Post-Compromise security exactly?
After reading these papers on Post-Compromise Security:
Post Compromise Security
Asynchronous Ratcheting Trees
My understanding is the following: it is possible for a key-agreement protocol to ...
32
votes
3answers
4k views
How can I make sure non-open source programs are really using end-to-end encryption?
Without going deep into math, is there a way to make sure that non-open source programs like WhatsApp, FaceTime, Zoom, etc. are really using end-to-end encryption instead of just 'regular encryption' (...
2
votes
1answer
173 views
Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?
I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have ...
0
votes
1answer
61 views
How modern messengers encryption keys can't be hacked [closed]
I dont know is this question more like reverse-engineering or cryptographic.
Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
1
vote
1answer
201 views
Curve25519 key exchange in detail
So I'm trying to understand how the key exchange with Curve25519 works. I read the original Paper from Bernstein "Curve25519: new Diffie-Hellman speed records", but I still got some questions. First ...
0
votes
2answers
173 views
Why is Curve25519 mostly used for key exchange?
When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema.
I know, that Curve25519 has a pretty ...
0
votes
0answers
16 views
CP-ABE secure key management
I want to use CP-ABE (Ciphertext Policy- Attribute-Based Encryption) schemes for multicast communication. How can I share both the public key and secret key among the user? How I do set up an ...
1
vote
2answers
67 views
Standards for finite-field discrete log cryptography
The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
0
votes
1answer
51 views
Research topics related to cryptography and Hamiltonian cycles
I am very interested in pursuing a research where I can show an application of Hamiltonian cycles in Cayley graphs of some group such as reflection groups to the field of cryptography.
But currently ...
1
vote
1answer
49 views
DHE parameters: which parameters need to be random each time?
In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange ...
0
votes
0answers
81 views
Interactive ECDHE Authentication With Numeric Code
Trying to simplify my question, keeping only core concepts.
Proposed solution:
Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret.
Device that requests ...
1
vote
0answers
30 views
Does the order of the “Finished” messages matter in SSL/TLS?
In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session ...
3
votes
1answer
276 views
For Diffie-Hellman, why is a g value of p−1 not a suitable choice?
I am currently learning about the Diffie-Hellman key exchange. I understand that for a $g$ of $1$, the resulting key would always end up as $1$ which would obviously not be secure.
I read that the $p\...
0
votes
0answers
28 views
Using PSK starting a new session, encrypt the new session key with old, or sign a derivative to be used on the old key?
I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total.
...
0
votes
0answers
52 views
Trying to understand how the same secret key end up being calculated between Alice and Bob
This is basically a duplicate of this question which was not answered very clearly. From the documentation, these are the calculations that happen for Alice to compute the shared secret key:
...
2
votes
1answer
118 views
Why is there no “ephemeral non-DH EC” key exchange in TLS?
In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy.
In ECDHE key ...
4
votes
2answers
153 views
what does output parameters of lwe estimator stands for?
I want to use lwe estimator to find classical and quantum security of my proposed key exchange protocol. On this website, I want to understand the output of sage code on lwe estimator given bellow.
...
0
votes
1answer
61 views
On an EKE (Encrypted Key Exchange) what would happen if asymmetric key would be symmetric?
On EKE where the user sends a password encrypted public key and receives a password encrypted and public key encrypted secret key. What would happen if these asymmetrical keys would become symmetrical?...
4
votes
2answers
325 views
Key Exchange vs Key Encapsulation
From what I understand, the steps of a key exchange protocol are
Alice and Bob each encrypt something using their public key and private key and send the result to each other
Alice and Bob each do ...
0
votes
1answer
32 views
In the SIKE known answer tests, why is there only one secret key?
I'm looking at the SIKE known answer tests and am realizing that I'm confused on all the different terms in a Diffie-Hellman key exchange.
From the Wikipedia page, I would think there would be a ...
0
votes
0answers
25 views
Security of Half-Key Key Management Scheme
I am interested in algorithms that consume as less space available on a memory, for low consuming power devices such as wireless nodes. From a search I have found this article here:
https://dl.acm....
1
vote
0answers
31 views
How keeloq keyfob exchange key with receiver in the first place?
After reading a lot of articles and the microship maunal for keeloq IC, I think I understand how the encryption and decrytion works. If I understand correctly, however, the decryption require the ...
1
vote
1answer
89 views
DH Key Exchange Protocol
Since I am not able to comment under the topic, I would like to ask here why in question 2 old post, we cannot distinguish the two distributions, even with unlimited computational power? Also, what ...
1
vote
1answer
244 views
Diffie-Hellman key exchange protocol with finite field GF(2^5)
In a Diffie-Hellman key exchange protocol, the system parameters are given as
follows: finite field $GF(2^5)$ defined with irreducible polynomial $f(x) = x^5 + x^2 + 1$ and
primitive element $\alpha= ...
