Questions tagged [key-exchange]

Key exchange protocols allow two parties to produce a secret session key over a public channel.

Filter by
Sorted by
Tagged with
2
votes
1answer
44 views

Significance of y-coordinates in ECDH public key exchange

In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019, they talk about attacks in Bluetooth pairing, they state that in the ...
1
vote
0answers
20 views

Purpose of signing the signed prekey in X3DH?

I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
2
votes
0answers
37 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
3
votes
1answer
69 views

Good key update algorithms for key evolving schemes

In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$. What is a ...
2
votes
1answer
49 views

Why is this authenticated Diffie–Hellman key exchange insecure?

I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember $$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$ $$B\to A: (B, g^...
2
votes
0answers
17 views

Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?

Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
1
vote
1answer
50 views

MQV protocol and man-in-middle attack

Why MQV is said to be an “authenticated Diffie-Hellman” protocol? The process in the picture shows nothing about authentication. Besides, a man-in-middle can impersonate B to negotiate with A, because ...
0
votes
0answers
13 views

Isogeny-based AKE: what is the difference between Gal 1 and FTTY 1?

What is the difference between (a) the AKE scheme proposed by Galbraith (based on TS2 protocol) in https://eprint.iacr.org/2018/266.pdf (page 9-10); and (b) the AKE scheme proposed by Fujioka et al. ...
4
votes
1answer
60 views

Can libsodium's X25519 encryption construction be generalized?

It is my understanding that libsodium's sealed_box is based on X25519, a Diffie-Hellman function: By combining the X25519 key agreement with a symmetric cipher and having a recipient derive the ...
1
vote
0answers
31 views

Server distributing/sharing a symmetric key to one or more clients via an established secure connection?

I have a server and a client device that share two separate data channels that each need to have authentication and encryption protections. When a connection is made over data channel 1, it is secured ...
0
votes
1answer
26 views

Key Agreement between two nodes of a Wireless Sensor Network

Can there be a way to form a shared secret key between two nodes of a Wireless Sensor Network who are more than one hop away, simply on the basis of their IDs?
0
votes
0answers
31 views

Password-based chosen-basis computational Diffie-Hellman assumption

In Simple Password-Based Encrypted Key Exchange Protocols, the authors proposed a hard assumption as follows. Experiment $Exp^{pccdh}_{\mathbb{G}, n}(\mathcal{A}, M, N, X^{'}, \mathcal{P})$ $(Y^{'}, ...
1
vote
0answers
31 views

Transcript collisions and hash collisions in (password) key exchange protocol

In New Security Results on Encrypted Key Exchange, there is a Game 2 as follows: Game $G_{2}$: For an easier analysis in the following, we cancel games in which some (unlikely) collisions appear: ...
0
votes
2answers
114 views

How to encrypt with elliptic curve cryptography (ECC)?

I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works. Why can't you ...
0
votes
0answers
20 views

Can we use HMQV in an asynchronous setting?

Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following: $\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral ...
1
vote
0answers
62 views

is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?

After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
1
vote
1answer
50 views

Do all PAKE assume that all parties already have a password?

I was looking for a means to perform a key exchange without relying on a PKI. I discovered Password Authenticated Key Exchange (PAKE) and after reading J-PAKE; I have the following questions: Do PAKE ...
0
votes
1answer
55 views

Diffie-Hellman Decryption with A, B, p, g, cipher Parameters

I have a Crypto assignment, trying different ideas for couple hours landed me nowhere. Supposedly during a Diffie-Hellman key exchange Alice sends bob an encrypted message, the message (cipher) is a ...
0
votes
0answers
23 views

Are there any known problems performing a One-time pad with 2 keys stored separately - AKA 2 part Symmetric key exchange over TLS

If this is something that already has a name, please tell me to look at that, but I have not been able to find one yet. I am considering this process for storing some data securely. I want to ...
0
votes
0answers
36 views

Is the password based key exchange secure even if the public key is known to adversary?

I am assuming the answer for part 1 to be a "NO" as the adversary knows the public key he can get the password by offline attack IN part 2 : the answer is "yes" as the public key is freshly generated ...
0
votes
0answers
19 views

Why MQV scheme need a half coordinate?

Recently I get to know the MQV key agreement in a lecture. the protocol is quite simple MQV My question is why there is a $\hat X and$ $\hat Y$ in the protocol, it does not seem natural at all, does ...
0
votes
1answer
49 views

Possibility of Man-in-the-Middle on X3DH

I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is ...
0
votes
0answers
32 views

Diffie-Hellman Key Exchange - Key Derivation before Execution

I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
0
votes
1answer
79 views

What is the definition of dummy password?

Recently, I try to read some papers about Password Authenticated Key Exchange (PAKE). I can’t understand the meaning of “dummy password .” Can someone gives a concrete definition of it. And what is ...
0
votes
2answers
85 views

Random Oracle to prove an Authenticated DH protocol

I am trying to understand how they use the random oracle to solve the CDH. For example, in the security proof on page 7 of the following paper; A Lightweight Message Authentication Scheme for Smart ...
0
votes
1answer
62 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
1
vote
0answers
78 views

What is Post-Compromise security exactly?

After reading these papers on Post-Compromise Security: Post Compromise Security Asynchronous Ratcheting Trees My understanding is the following: it is possible for a key-agreement protocol to ...
32
votes
3answers
4k views

How can I make sure non-open source programs are really using end-to-end encryption?

Without going deep into math, is there a way to make sure that non-open source programs like WhatsApp, FaceTime, Zoom, etc. are really using end-to-end encryption instead of just 'regular encryption' (...
2
votes
1answer
173 views

Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?

I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have ...
0
votes
1answer
61 views

How modern messengers encryption keys can't be hacked [closed]

I dont know is this question more like reverse-engineering or cryptographic. Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
1
vote
1answer
201 views

Curve25519 key exchange in detail

So I'm trying to understand how the key exchange with Curve25519 works. I read the original Paper from Bernstein "Curve25519: new Diffie-Hellman speed records", but I still got some questions. First ...
0
votes
2answers
173 views

Why is Curve25519 mostly used for key exchange?

When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema. I know, that Curve25519 has a pretty ...
0
votes
0answers
16 views

CP-ABE secure key management

I want to use CP-ABE (Ciphertext Policy- Attribute-Based Encryption) schemes for multicast communication. How can I share both the public key and secret key among the user? How I do set up an ...
1
vote
2answers
67 views

Standards for finite-field discrete log cryptography

The NIST and TLS standards for Diffie-Hellman key exchange over a finite field all work in a subgroup of ${\mathbb Z}_p^*$ having prime order $q$, where $p = 2q+1$. On the other hand, DSA has a larger ...
0
votes
1answer
51 views

Research topics related to cryptography and Hamiltonian cycles

I am very interested in pursuing a research where I can show an application of Hamiltonian cycles in Cayley graphs of some group such as reflection groups to the field of cryptography. But currently ...
1
vote
1answer
49 views

DHE parameters: which parameters need to be random each time?

In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange ...
0
votes
0answers
81 views

Interactive ECDHE Authentication With Numeric Code

Trying to simplify my question, keeping only core concepts. Proposed solution: Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret. Device that requests ...
1
vote
0answers
30 views

Does the order of the “Finished” messages matter in SSL/TLS?

In SSL 3.0 and TLS versions 1.0 through 1.2 the last two messages are the "Client Finished" followed by "Server Finished" messages. These messages include an encrypted (under the established session ...
3
votes
1answer
276 views

For Diffie-Hellman, why is a g value of p−1 not a suitable choice?

I am currently learning about the Diffie-Hellman key exchange. I understand that for a $g$ of $1$, the resulting key would always end up as $1$ which would obviously not be secure. I read that the $p\...
0
votes
0answers
28 views

Using PSK starting a new session, encrypt the new session key with old, or sign a derivative to be used on the old key?

I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total. ...
0
votes
0answers
52 views

Trying to understand how the same secret key end up being calculated between Alice and Bob

This is basically a duplicate of this question which was not answered very clearly. From the documentation, these are the calculations that happen for Alice to compute the shared secret key: ...
2
votes
1answer
118 views

Why is there no “ephemeral non-DH EC” key exchange in TLS?

In RSA key exchange, the client picks a premaster secret and encrypts it with the RSA public key in the server certificate, and sends it to the server. This offers no forward secrecy. In ECDHE key ...
4
votes
2answers
153 views

what does output parameters of lwe estimator stands for?

I want to use lwe estimator to find classical and quantum security of my proposed key exchange protocol. On this website, I want to understand the output of sage code on lwe estimator given bellow. ...
0
votes
1answer
61 views

On an EKE (Encrypted Key Exchange) what would happen if asymmetric key would be symmetric?

On EKE where the user sends a password encrypted public key and receives a password encrypted and public key encrypted secret key. What would happen if these asymmetrical keys would become symmetrical?...
4
votes
2answers
325 views

Key Exchange vs Key Encapsulation

From what I understand, the steps of a key exchange protocol are Alice and Bob each encrypt something using their public key and private key and send the result to each other Alice and Bob each do ...
0
votes
1answer
32 views

In the SIKE known answer tests, why is there only one secret key?

I'm looking at the SIKE known answer tests and am realizing that I'm confused on all the different terms in a Diffie-Hellman key exchange. From the Wikipedia page, I would think there would be a ...
0
votes
0answers
25 views

Security of Half-Key Key Management Scheme

I am interested in algorithms that consume as less space available on a memory, for low consuming power devices such as wireless nodes. From a search I have found this article here: https://dl.acm....
1
vote
0answers
31 views

How keeloq keyfob exchange key with receiver in the first place?

After reading a lot of articles and the microship maunal for keeloq IC, I think I understand how the encryption and decrytion works. If I understand correctly, however, the decryption require the ...
1
vote
1answer
89 views

DH Key Exchange Protocol

Since I am not able to comment under the topic, I would like to ask here why in question 2 old post, we cannot distinguish the two distributions, even with unlimited computational power? Also, what ...
1
vote
1answer
244 views

Diffie-Hellman key exchange protocol with finite field GF(2^5)

In a Diffie-Hellman key exchange protocol, the system parameters are given as follows: finite field $GF(2^5)$ defined with irreducible polynomial $f(x) = x^5 + x^2 + 1$ and primitive element $\alpha= ...

1
2 3 4 5
11