We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [key-exchange]

Key exchange protocols allow two parties to produce a secret session key over a public channel.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?

I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can'...
-1
votes
0answers
22 views

Diffie-Hellman key exchange in four parties

I understand the concept of 2 and 3 parties Here is the code of 3 parties ...
2
votes
1answer
24 views

Simply using password as a third “private key” for PAKE

I'm reading through the development of PAKE protocols, starting with EKE and SPEKE, their potential pitfalls, and what motivates their protocol choices. And I've been wondering, what is wrong with the ...
0
votes
1answer
92 views

Diffie-Hellman Key Exchange attack on small secret keys

The question as the title suggests is based on the key exchange with Diffie-Hellman protocol and is something like this: *"We have intercepted a communication between Alice and Bob: intercepted-...
0
votes
0answers
14 views

First setup security protocols (key transfer) in not-secure environment [migrated]

This question might very well be more a confirmation than anything else, but I'm breaking my head over a problem I try to solve. I hope someone can either confirm my thoughts or tell me something I'm ...
2
votes
2answers
69 views

Is there a key exchange protocol that requires only one message?

Say I want to exchange a secret with someone, but I only get to send one message to the other person, and then we encrypt with that secret. Diffie-Hellman and ECDH require multiple messages to be sent ...
0
votes
1answer
56 views

HMAC based Key exchange

Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$. Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and ...
2
votes
2answers
47 views

Is there any problem to reuse the prime p, g and a in Diffie-Hellman?

Suppose I always reuse p, g and a in DH and there is someone monitoring my communication. Is there a way this person can use this to perform some kind of attack to me? I believe that reusing p and g ...
0
votes
1answer
60 views

Is CECPQ2 forward secure?

Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers? I know that it is using HRSS+SKY as the post-quantum part of the key ...
2
votes
1answer
61 views

Why are PAKE protocols not widely used?

While there are plenty of PAKE protocols, especially those augmented ones which are practical in C/S model, actually they seem to be not widely used. Even TLS-Standardized SRP, the most popular one ...
0
votes
1answer
66 views

Is this PGP key exchange secure?

I am currently trying to create a secure key exchange between two parties. I have a good implementation of PGP that works well for my app, but my DH is really slow and doesn't work well; so I was ...
1
vote
1answer
42 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...
1
vote
1answer
42 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
1
vote
1answer
41 views

Size of Key Material of TLS_DHE_RSA_WITH_AES_256_CBC_SHA

What is the size of key material required for generating MAC keys, encryption keys and IV when use TLS_DHE_RSA_WITH_AES_256_CBC_SHA ? How to calculate it?
1
vote
1answer
49 views

Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?

Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other. One way to do this is to simply copy A's cert over to B's allowed ...
0
votes
1answer
50 views

Calculate shared key having A public Key and B private Key (Diffie Hellman)

I cannot understand how this works. $\text{A}_\text{public} = g^a \bmod p$ $\text{B}_\text{private} = \text{B}$ $\text{g} = p$ I also have $p$, I need to get the shared key, that I know both $\...
3
votes
1answer
175 views

Decrypting arbitrary numbers with RSA

I want to construct a hash-chain where I want to share millions of small AES-128 keys with Bob over a period of time. Bob should not be able to predict the future keys if he knows the past keys. I ...
2
votes
1answer
58 views

TLS_DH_RSA_* cipher, how can static DH use an RSA certificate?

I am confused about TLS_DH_RSA_* ciphers because, for DH to work, the server certificate has to include a DH public key, but for server authentication the server certificate needs an RSA public key. ...
0
votes
1answer
62 views

Is it safe to use shared secret as a symmetric key in one way communication?

I have a one way communication from one device to another, which needs to be secure and there cannot be any feedback in the other direction. Now both sides happen to have ECC P-256 key pairs and they ...
2
votes
1answer
53 views

Understanding need for PKI

For simplicity let's say I only have RSA and AES on my hands and I want Alice to talk with Bob over a secure channel. With secure I am implying no MITM and Alice and Bob know they are talking to each ...
3
votes
3answers
131 views

Struggling to understand Perfect Forward Secrecy

From the definition on Wikipedia: In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that ...
1
vote
1answer
40 views

How to handle multiple key-agreements

If I would use two different key-agreements e.g. SIDH and ECDH how would I handle these both derived keys? Is there a different between XOR or SHA-256 the two keys? (Would one reduce the level of ...
0
votes
1answer
85 views

Why are the session keys in DHKE for different values of 'a' the same?

In a DHKE scheme with the a prime p = 467. an element g = 4. The element 4 has order 233 and generates thus a subgroup with 233 elements. after Computing the common key for A. a=400, b=134 B. a=167, b=...
2
votes
1answer
41 views

Calculation of failure probability in basic Ring-LWE-DH key agreement

This is the basic unauthenticated Ring-LWE-based Diffie-Hellman key exchange, based on Peikert's Ring-LWE KEM: (from BCNS15) Alice and Bob have shared public polynomial $a$ randomly drawn from $R_q = ...
2
votes
1answer
100 views

Other than an exponent greater than 1, what are the considerations when creating a random 256-bit private key using Diffie Hellman?

Let's assume that I choose the bits for my 256-bit private key exponent by flipping a coin 256 times. Are there any other issues, besides the randomness of the 256-bit private key to consider? For ...
4
votes
1answer
170 views

Complete Attack on RLWE Key Exchange with reused keys, without signal leakage

I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme. I am unable to ...
2
votes
1answer
92 views

SIDH: key agreement - why does it work?

In SIDH both parties agree on the key in following way: Alice calculates a kernel $R = mPB + nQB$ Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$ She uses $\...
0
votes
0answers
57 views

Can I use XOR to establish a longer shared secret?

SIKEp434 can only be used to encapsulate a 16 byte (128 bit) shared secret key. Most encryption algorithms these days (specifically (X)ChaCha20) require a 256 bit key to be secure, especially in a ...
1
vote
0answers
49 views

From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure

I have to solve this exercise and I really could use some help: Show that any 2-round key-exchange protocol (that is, where each party sends a single message) satisfying $Definition$ $9.1$ can be ...
0
votes
1answer
42 views

Key exchange without an underlying semigroup

I am wondering whether there is a general reformulation of perfect forward secrecy for 2 party key exchange in 2 messages using semigroups. I am looking for references, which would discuss such ...
2
votes
1answer
45 views

Generate a per data shared secret vs per session

I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
0
votes
1answer
53 views

How to prevent Public Key from being replaced entirely?

I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the <...
0
votes
2answers
215 views

What is the difference between forward secrecy and key freshness?

Is all random private key that generating a unique session key is both forward secrecy and key freshness?
3
votes
1answer
152 views

Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
0
votes
1answer
123 views

Diffie-Hellman and secret key size

How can one guarantee that the generated DH secret key is of certain length? Say 256bit. Actually, prime length is not enough since the remainder of the last process, the modulus, may result in too ...
0
votes
0answers
51 views

Decentralized / Distributed Private Key Generation between Untrusted Parties?

I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows: "Decentralized private key generation – Multiple Enigma nodes ...
0
votes
0answers
33 views

How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]

In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
2
votes
2answers
153 views

How to Understand Authenticated Key Exchange?

I am reading some articles about key exchange. I know classic key exchange, such as Diffie-Hellman key exchange. This type of algorithm is vulnerable to man-in-the-middle attack. However, when using a ...
1
vote
1answer
41 views

Can I do a forward secure half-round ephemeral-static ECDH?

In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below: ECC key pairs for open ID ...
1
vote
0answers
65 views

If 1 can be a random number in Diffie-Hellman Algorithm

I've done some calculations and Diffie-Hellman Algorithm worked for all chosen random numbers except $1$. In the description of the algorithm, I can't find information that the random number has to be ...
3
votes
1answer
127 views

How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?

I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
1
vote
1answer
172 views

When do clients use TLS in PSK mode?

The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
4
votes
1answer
850 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
1
vote
1answer
174 views

Key-Exchange in Steganography

I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the ...
7
votes
0answers
106 views

Differences between “NewHope” and “NewHope-simple”

The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
6
votes
1answer
140 views

Key confirmation and other benefits of double ratchet

I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting. This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
3
votes
2answers
309 views

In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?

I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are. The closest I've come to is ...
1
vote
1answer
63 views

Diffie-Hellman: Recommendation of the base size?

Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
0
votes
0answers
36 views

Two-party symmetric key establishment protocol

I need a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any ...
0
votes
1answer
169 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...