Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
558
questions
1
vote
1answer
31 views
What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?
This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results.
As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
35 views
Comparing Diffie Hellman and EC Diffie Hellman sizes
So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the ...
2
votes
1answer
32 views
Intuitive explanation for key exchange with public/private keys
I want to teach some people about crypto basics, and one of the topic will be key exchange with a public and private keys.
The audience is made of people working in InfoSec, but mostly junior fresh ...
2
votes
1answer
63 views
What does DH(IPKa, IPKb) notation mean? Diffie-Hellman confusion
I'm trying to implement X3DH (extended triple Diffie-Hellman) in a network of mine.
The way I understand it, a bundle (IPKb,SPKb,OTKb) is retrieved by Alice from Bob, through the server, and
using her ...
3
votes
1answer
44 views
Is the following PAKE protocol UC secure?
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
1
vote
1answer
46 views
what motivated the design decisions of RFC 8291 (“Message Encryption for Web Push”)?
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
0answers
23 views
Does IND-CPA to INC-CCA effects on the error probability?
If we have a key encapsulation mechanism (KEM) that is IND-CPA secure, with some error probability $P_e$ (probability that the shared keys are not equal).
The goal is to use the Fujisaki-Okamoto ...
0
votes
0answers
13 views
AKE using Noise_NNpsk2 vs Noise_NKpsk2
I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward ...
1
vote
0answers
50 views
How efficiently can an attacker forge parts of a fingerprint?
If two devices do not trust each other yet, you can't simply send the correct fingerprint across: you have to manually verify it. I am looking into the security of comparing only random parts of a ...
1
vote
0answers
31 views
Simple description of a multi-party fair exchange protocol with trusted third-party
Imagine Alice wants to sell a file with important information to Bob for money. The file must be encrypted, so nobody can eavesdrop. It must also be signed upfront, so Bob knows it has not been ...
1
vote
1answer
69 views
Is there any standard present to measure strength of a generated key using true random number generator?
I was wondering how to measure the security strength of a generated secret key for the below protocol:
"A 128 bit random number is generated by TRNG and the random number will be used as a ...
-1
votes
1answer
70 views
Finding Diffie-Hellman secret key with only some know values [closed]
I currently have the following information and I assume the first line separated by the : represents the prime number and generator. Is there any way I can find the secret key shared for the diffie-...
0
votes
0answers
24 views
In group key agreement/exchange protocols, does key independence implies forward and backward secrecy?
Kim et al. [here] define Foward and Backward secrecy as follows:
Forward Secrecy (not perfect foward secrecy): the inability for a passive attacker to obtain past group keys from a subset of new ...
2
votes
0answers
30 views
What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?
From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf
The 8192128 parameter set is bigger, but the ...
1
vote
0answers
59 views
Dragonfly masked DH
I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
0
votes
1answer
58 views
Can we do Multi-Prime Diffie-Hellman?
What is the correct way, if any, to do Multi-Prime DH?
From security point of view, is there any benefit to do it?
Multi-Prime is not about multi participants.
Multi prime is when we use two or more ...
0
votes
0answers
34 views
Diffie Hellman with Smartwatch
I am trying to reverse engineer the Handshake wit a Smartwatch by sniffing the BLE traffic.
There is what I figured out and were able to reproduce:
The manufacturer-app requests a random number from ...
6
votes
1answer
251 views
Curve25519 Key Validation
According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from?
Is there any proof ...
2
votes
2answers
92 views
How to exchange keys despite a MITM, using some short known password?
The simple scenario is two devices on one WiFi network sitting side by side. The user can copy a short code from one device to the other to be the "password" however this code can't be too ...
0
votes
1answer
27 views
How to sign messages using the NOISE Protocol Framework?
I wanted to learn more about secure messaging and started a personal project using the libhydrogen library. From my understanding, instead of using public-key ...
0
votes
1answer
106 views
ECDH/ECDSA key exchange on embedded devices
Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to ...
4
votes
2answers
158 views
MAC-then-encrypt in SIGMA protocol for authenticated key exchange
The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption.
The SIGMA-I variant illustrated below ...
1
vote
1answer
88 views
Post-quantum asymmetric encryption algorithms
One could use Falcon-512 for establishing a private and public key for an asymmetric context. Whereas in a symmetric context, we could use firesaber/saber/variants in order to obtain a shared secret ...
0
votes
0answers
60 views
Key storage management of session keys and long term keys
In key management, one of the topics is key storage, I want to know where and how these keys(long-term and short-term) are stored?
For example I read that android password apps use KeyStore api to ...
0
votes
1answer
62 views
Symmetric Exchange Key Sharing
Question:
Suppose that there are 10000 = 10^4 banks and 10 payment card organisations (PCOs).
How many secret keys will be needed if each PCO shares a unique secret key with each bank?
How many extra ...
6
votes
2answers
294 views
Is this variant of Diffie-Hellman viable and quantum resilient?
In this paper the author suggests using a variant of Diffie-Hellman which involves floating-point numbers of arbitrary size in the generation of a shared secret. There are no primes, calculations are ...
0
votes
0answers
42 views
Securely transmit signed token (e.g., JWT) over insecure channel
Apologies if this is already answered somewhere, but I could not find it.
I have a setup where a client has a JWT (RSA- or ECDSA-signed), and needs to prove that fact to the peer which issued the ...
10
votes
2answers
2k views
Why is this not a viable key exchange algorithm? [duplicate]
I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys:
Alice decides on a key she wishes to share with Bob.
Alice generates a stream of bytes ...
2
votes
1answer
69 views
Rounding function used in Saber Key Exchange
In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows:
$bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...
0
votes
1answer
77 views
TLS 1.2 Server Key Exchange problem
Below the Wireshark snapshot of the handshake compliant to the TLS 1.2.
The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
1
vote
2answers
51 views
Can TLS be used simply to exchange keys using the handshake protocol?
From what I understand, in general, TLS consists of two protocols:
1 - Handshake protocol: uses public-key cryptography (ECDH, DH) to establish a shared secret between the client and server.
2 - ...
0
votes
0answers
39 views
Security Proof, Sequence of games and birthday paradox
The sequence of games security proof approach is very confusing. For example, I am trying to understand it in the following paper
https://www.dropbox.com/s/dhsgsognxviwacv/Provably%20Secure%...
3
votes
1answer
132 views
Can Key-Encryption Key (KEK) be symmetric?
This from Cryptography course from Coursera:
Key wrapping or encapsulation using a KEK can be accomplished using
either symmetric or asymmetric cipher
For my information KEK solves the key ...
3
votes
2answers
312 views
If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?
There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams ...
0
votes
1answer
81 views
How to securely share AES key between two remote devices (client and server) through UDP protocol?
I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key ...
2
votes
1answer
943 views
How to generate the exact AES key in both client and server side?
I am using AES to create a secure tunnel for transmission of data.
As the symmetric key encryption will require the same key to encrypt and decrypt, so we need to generate the exact same key for the ...
1
vote
0answers
33 views
Is there an implemented Id-based key exchange protocol?
I need to use some kind of authentication of the client during my key exchange process.
During my research, in this article I learned about identity-based key exchange and authentication, and I was ...
1
vote
0answers
31 views
Decryption : How to secure the Key in offline mode [closed]
I am new to cryptography.
I have a package to be shared with Bob which is something like below:
Package contains: data.zip and Application
where,
data.zip is ...
0
votes
1answer
32 views
The title of the protocol and explanation of the steps required
The secure third party R generates key $k_1$ to communicate with A and $k_2$ to communicate with B.
A requests a key with which to communicate with B.
R generates k un and encrypts:
$E_{k_1}(k) = s1;...
6
votes
0answers
142 views
About a SETUP mechanism on ECDH
I'm following these three articles:
Kleptography: Using Cryptography Against Cryptography,
Kleptographic Attack on Elliptic Curve Based
Cryptographic Protocols and
Elliptic Curve Kleptography .
In ...
0
votes
1answer
59 views
Key generation for DH key exchange - benefits of using KMI
Context
We need to generate a key pair in order to perform DH key exchange with the other party.
Some suggest to use a KMI solution (think: AWS KMS or like) in order to generate the key pair.
...
0
votes
1answer
165 views
Why should I export my private key instead of well known asymmetric crypto mechanism on openkeychain?
I'm trying to use password-store as password manager under linux. I created a private github repo with my gpg files in order to use it with other devices. I installed android-password-store app for ...
2
votes
0answers
93 views
Negotiating a session key, when only one public-key is exchanged via QR Code
Question
I want to create a secure channel between a server and a client. It is only important that the client can verify the identity of the server, not the other way around.
In my special case, an ...
2
votes
1answer
65 views
MitM with regard to unauthenticated clients
I'm trying to understand how man-in-the-middle attacks are prevented during key exchanges, and am confused by this Wikipedia statement:
Use of mutual authentication, in which both the server and the ...
2
votes
1answer
98 views
Why does dragonfly key exchange need hunting and pecking?
The dragonfly key exchange scheme (as used by WPA3) received criticism because the way it chooses a generator of the elliptic curve group ('hunting and pecking') is a non-constant time algorithm ...
2
votes
1answer
111 views
Significance of y-coordinates in ECDH public key exchange
In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019,
they talk about attacks in Bluetooth pairing, they state that in the ...
1
vote
1answer
151 views
Purpose of signing the signed prekey in X3DH?
I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
3
votes
0answers
72 views
Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?
While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
3
votes
1answer
83 views
Good key update algorithms for key evolving schemes
In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$.
What is a ...
2
votes
1answer
196 views
Why is this authenticated Diffie–Hellman key exchange insecure?
I was searching for the information on authenticated Diffie–Hellman key exchange and found these slides. The author says, “Remember
$$A\to B: (A, g^x, \operatorname{SIG}_a((g^x, B)))$$
$$B\to A: (B, g^...
