Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
466
questions
0
votes
0answers
8 views
Is a Diffie-Hellman scheme in which parties always use the same public keys vulnerable?
I have come across a couple of protocols in which the public keys of the parties are static across conversations, even with different users. Something about this makes my hairs stand on end but I can'...
-1
votes
0answers
22 views
Diffie-Hellman key exchange in four parties
I understand the concept of 2 and 3 parties
Here is the code of 3 parties
...
2
votes
1answer
24 views
Simply using password as a third “private key” for PAKE
I'm reading through the development of PAKE protocols, starting with EKE and SPEKE, their potential pitfalls, and what motivates their protocol choices. And I've been wondering, what is wrong with the ...
0
votes
1answer
92 views
Diffie-Hellman Key Exchange attack on small secret keys
The question as the title suggests is based on the key exchange with Diffie-Hellman protocol and is something like this:
*"We have intercepted a communication between Alice and Bob: intercepted-...
0
votes
0answers
14 views
First setup security protocols (key transfer) in not-secure environment [migrated]
This question might very well be more a confirmation than anything else, but I'm breaking my head over a problem I try to solve. I hope someone can either confirm my thoughts or tell me something I'm ...
2
votes
2answers
69 views
Is there a key exchange protocol that requires only one message?
Say I want to exchange a secret with someone, but I only get to send one message to the other person, and then we encrypt with that secret. Diffie-Hellman and ECDH require multiple messages to be sent ...
0
votes
1answer
56 views
HMAC based Key exchange
Alice and Bob need to share public keys to sign/verify ephemeral keys. They have a secret key $K$.
Alice generates a 32 bytes random number $A$, computes $\operatorname{HMAC-SHA256}(K, M||A)$ and ...
2
votes
2answers
47 views
Is there any problem to reuse the prime p, g and a in Diffie-Hellman?
Suppose I always reuse p, g and a in DH and there is someone monitoring my communication. Is there a way this person can use this to perform some kind of attack to me?
I believe that reusing p and g ...
0
votes
1answer
60 views
Is CECPQ2 forward secure?
Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers?
I know that it is using HRSS+SKY as the post-quantum part of the key ...
2
votes
1answer
61 views
Why are PAKE protocols not widely used?
While there are plenty of PAKE protocols, especially those augmented ones which are practical in C/S model, actually they seem to be not widely used. Even TLS-Standardized SRP, the most popular one ...
0
votes
1answer
66 views
Is this PGP key exchange secure?
I am currently trying to create a secure key exchange between two parties. I have a good implementation of PGP that works well for my app, but my DH is really slow and doesn't work well; so I was ...
1
vote
1answer
42 views
Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time
I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...
1
vote
1answer
42 views
Ensure Data Integrity In An ECDH Key Excange
Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
1
vote
1answer
41 views
Size of Key Material of TLS_DHE_RSA_WITH_AES_256_CBC_SHA
What is the size of key material required for generating MAC keys, encryption keys and IV when use TLS_DHE_RSA_WITH_AES_256_CBC_SHA ?
How to calculate it?
1
vote
1answer
49 views
Is this pairing scheme for establishing trust between two devices with self-signed TLS certs secure from MITM?
Assume two devices (A and B) with self-signed TLS certificates (this part can't change). We want these devices to trust each other.
One way to do this is to simply copy A's cert over to B's allowed ...
0
votes
1answer
50 views
Calculate shared key having A public Key and B private Key (Diffie Hellman)
I cannot understand how this works.
$\text{A}_\text{public} = g^a \bmod p$
$\text{B}_\text{private} = \text{B}$
$\text{g} = p$
I also have $p$, I need to get the shared key, that I know both $\...
3
votes
1answer
175 views
Decrypting arbitrary numbers with RSA
I want to construct a hash-chain where I want to share millions of small AES-128 keys with Bob over a period of time. Bob should not be able to predict the future keys if he knows the past keys. I ...
2
votes
1answer
58 views
TLS_DH_RSA_* cipher, how can static DH use an RSA certificate?
I am confused about TLS_DH_RSA_* ciphers because, for DH to work, the server certificate has to include a DH public key, but for server authentication the server certificate needs an RSA public key. ...
0
votes
1answer
62 views
Is it safe to use shared secret as a symmetric key in one way communication?
I have a one way communication from one device to another, which needs to be secure and there cannot be any feedback in the other direction. Now both sides happen to have ECC P-256 key pairs and they ...
2
votes
1answer
53 views
Understanding need for PKI
For simplicity let's say I only have RSA and AES on my hands and I want Alice to talk with Bob over a secure channel. With secure I am implying no MITM and Alice and Bob know they are talking to each ...
3
votes
3answers
131 views
Struggling to understand Perfect Forward Secrecy
From the definition on Wikipedia:
In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that ...
1
vote
1answer
40 views
How to handle multiple key-agreements
If I would use two different key-agreements e.g. SIDH and ECDH how would I handle these both derived keys?
Is there a different between XOR or SHA-256 the two keys? (Would one reduce the level of ...
0
votes
1answer
85 views
Why are the session keys in DHKE for different values of 'a' the same?
In a DHKE scheme with the a prime p = 467. an element g = 4. The element 4 has order 233 and generates thus a subgroup with 233 elements.
after Computing the common key for
A. a=400, b=134
B. a=167, b=...
2
votes
1answer
41 views
Calculation of failure probability in basic Ring-LWE-DH key agreement
This is the basic unauthenticated Ring-LWE-based Diffie-Hellman key exchange, based on Peikert's Ring-LWE KEM: (from BCNS15)
Alice and Bob have shared public polynomial $a$ randomly drawn from $R_q = ...
2
votes
1answer
100 views
Other than an exponent greater than 1, what are the considerations when creating a random 256-bit private key using Diffie Hellman?
Let's assume that I choose the bits for my 256-bit private key exponent by flipping a coin 256 times.
Are there any other issues, besides the randomness of the 256-bit private key to consider? For ...
4
votes
1answer
170 views
Complete Attack on RLWE Key Exchange with reused keys, without signal leakage
I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme.
I am unable to ...
2
votes
1answer
92 views
SIDH: key agreement - why does it work?
In SIDH both parties agree on the key in following way:
Alice calculates a kernel $R = mPB + nQB$
Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
She uses $\...
0
votes
0answers
57 views
Can I use XOR to establish a longer shared secret?
SIKEp434 can only be used to encapsulate a 16 byte (128 bit) shared secret key. Most encryption algorithms these days (specifically (X)ChaCha20) require a 256 bit key to be secure, especially in a ...
1
vote
0answers
49 views
From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure
I have to solve this exercise and I really could use some help:
Show that any 2-round key-exchange protocol (that is, where each party
sends a single message) satisfying $Definition$ $9.1$ can be ...
0
votes
1answer
42 views
Key exchange without an underlying semigroup
I am wondering whether there is a general reformulation of perfect forward secrecy for 2 party key exchange in 2 messages using semigroups. I am looking for references, which would discuss such ...
2
votes
1answer
45 views
Generate a per data shared secret vs per session
I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
0
votes
1answer
53 views
How to prevent Public Key from being replaced entirely?
I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the <...
0
votes
2answers
215 views
What is the difference between forward secrecy and key freshness?
Is all random private key that generating a unique session key is both forward secrecy and key freshness?
3
votes
1answer
152 views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
0
votes
1answer
123 views
Diffie-Hellman and secret key size
How can one guarantee that the generated DH secret key is of certain length? Say 256bit. Actually, prime length is not enough since the remainder of the last process, the modulus, may result in too ...
0
votes
0answers
51 views
Decentralized / Distributed Private Key Generation between Untrusted Parties?
I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows:
"Decentralized private key generation – Multiple Enigma nodes ...
0
votes
0answers
33 views
How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]
In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
2
votes
2answers
153 views
How to Understand Authenticated Key Exchange?
I am reading some articles about key exchange. I know classic key exchange, such as Diffie-Hellman key exchange. This type of algorithm is vulnerable to man-in-the-middle attack. However, when using a ...
1
vote
1answer
41 views
Can I do a forward secure half-round ephemeral-static ECDH?
In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:
ECC key pairs for open ID
...
1
vote
0answers
65 views
If 1 can be a random number in Diffie-Hellman Algorithm
I've done some calculations and Diffie-Hellman Algorithm worked for all chosen random numbers except $1$. In the description of the algorithm, I can't find information that the random number has to be ...
3
votes
1answer
127 views
How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?
I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
1
vote
1answer
172 views
When do clients use TLS in PSK mode?
The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
4
votes
1answer
850 views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
1
vote
1answer
174 views
Key-Exchange in Steganography
I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the ...
7
votes
0answers
106 views
Differences between “NewHope” and “NewHope-simple”
The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
6
votes
1answer
140 views
Key confirmation and other benefits of double ratchet
I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting.
This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
3
votes
2answers
309 views
In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?
I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are.
The closest I've come to is ...
1
vote
1answer
63 views
Diffie-Hellman: Recommendation of the base size?
Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
0
votes
0answers
36 views
Two-party symmetric key establishment protocol
I need a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any ...
0
votes
1answer
169 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
