Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-exchange]

Key exchange protocols allow two parties to produce a secret session key over a public channel.

0
votes
0answers
13 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
1
vote
0answers
39 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
5
votes
3answers
175 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
0
votes
1answer
35 views

Burmester Desmedt Key agreement. Is the division a floating point one or an integer one

As I look upon Burmester Desmedt algorithm: I notice that the intermediate key $K_i$ is getting calculated as: $K_i=(k_{i+1}/k_{i-1})^{x_i} \mod p$ Thus I wonder wheher the division $k_{i+1}/k_{i-1}...
1
vote
1answer
73 views

What happens if we choose the random secret keys in Diffie-Hellman greater than prime?

Diffie-Hellman works as follows: Given public parameters $p$ (a large prime) and $g$ (always referred to as a generator of $(\mathbb{Z}^∗_p)$. Then: Alice randomly chooses $a<p$ and sends $A\...
2
votes
1answer
47 views

Protocol that generates keys every 2 minutes using KDC

I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same key, I want to renew the session keys ...
1
vote
1answer
48 views

Can you construct a key agreement system from public-key-encryption system?

Can you construct a key agreement system from public-key-encryption system? If so, how? What about vice versa?
0
votes
0answers
28 views

Most energy-efficient authentication protocol?

I am looking for a cryptographic protocol that is as energy-efficient as possible. I am talking about battery drain. Alice wants to do a mutual authentication with Bob. Maybe symmetric is good, maybe ...
0
votes
0answers
27 views

Burmester Desmedt confused on the last step

I try to implement in code the traditional burmester desmedt algorithm for group key agreement: But I have the following question regarding the last step: $K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
1
vote
0answers
45 views

Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

In the original mDP protocol once all $z$ values received from each participant the following calculation is being done: If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then ...
0
votes
0answers
21 views

Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
0
votes
0answers
50 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
0
votes
0answers
48 views

Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
1
vote
0answers
54 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...
7
votes
2answers
436 views

Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN: It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
0
votes
0answers
11 views

Production Ready Message Format Standart for Key agreements on top of XMPP

Greedings, I try to run group key agreements on top of XMPP thus I want somehow a production used message format for key agreement. As far I found theese: XEP-0384: OMEMO Encryption XEP-0102 But all ...
3
votes
1answer
77 views

Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
0
votes
2answers
81 views

Is it possible to get different plaintexts from a single ciphertext using different keys?

Suppose to have a chipertext that you can't decrypt, but you know that the plaintext can be A, B or C. Then arrives to you the key which is used to encrypt the chipertext. You can decrypt the ...
6
votes
1answer
115 views

Why would the use of Curve25519 in Dragonfly leak information?

An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote: One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
1
vote
1answer
145 views

How does Dragonfly key exchange work, in non-white-paper terms?

I'm trying to understand WPA3, whose Simultaneous Authentication of Equals is supposedly similar to Dragonfly Key Exchange. Dragonfly is resistant to dictionary attacks, meaning that rather than an ...
1
vote
1answer
68 views

Why does DH-EKE require that public keys be indistinguishable from random?

The introduction to SPAKE pre-authentication states: Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman ...
3
votes
1answer
102 views

In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

According to KeyCDN, TLSv1.3 connections are established in a single round trip: While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip If ...
0
votes
1answer
32 views

Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages

Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the ...
1
vote
0answers
57 views

Simulatability of Diffie-Hellman Key Exchange

While reading through Shoup's paper on provably secure Diffie-Hellman key exchange (DHKE), I do not understand something rather simple. There are two parties $A$ and $B$. $A$ starts by sending $g^a$, ...
2
votes
2answers
95 views

Curve25519 Key Exchange Bit Security

Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw. Alice and Bob want to communicate securely over an insecure ...
6
votes
2answers
292 views

Do standalone Oblivious Transfer (OT) Protocols exist?

Are there any Oblivious Transfer (OT) protocols that don’t rely on asymmetrical encryption, public-key encryption or key-exchange? I’m starting to wonder, as all the OT protocols I know of (and can ...
3
votes
1answer
91 views

How to handle a lost key in Diffie-Hellman Key Exchange

I implemented the Diffie-Hellman Key Exchange algorithm but, I was wondering how to handle if one of the parties lost his key. Let's take a chat app as an example, Bob and Alice they used to have a ...
3
votes
1answer
88 views

Asynchronous Ratcheting Tree and modern group key agreements: Why left balanced-tres used?

Nowadays the group key agreements are based upon tree-based ones such as Asynchronous Ratcheting tree. Especially the latter one is constructed upon left-balanced tree. So I keep wondering what ...
3
votes
1answer
69 views

Change a secret key in an embedded device

There is a device that uses a secret key Sk to encrypt data. Assume this Sk is compromised. Could the following scheme be considered safe, in case we want to change the compromised Sk: We store some ...
1
vote
1answer
66 views

How to exchange a secret through untrusted server in two steps?

I have a web application where I control the server, however, it should not have any knowledge of secrets that are exchanged between its users. This server holds RSA public keys of each registered ...
1
vote
1answer
76 views

Publicly exchanging keys

my use case is the following: Sharing a secret on the blockchain from one participant over a smart-contracts with revealing the secret only after some condition is verified (another participant has ...
2
votes
2answers
65 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
2
votes
1answer
63 views

Why are computations (isogeny) in SIDH done in an extended prime field?

While reading the SIDH key exchange protocol, I noticed that all the isogeny computations and curves are defined over the extended prime field $\mathbb{F}_{p^2}$. Does it make the problem ...
1
vote
0answers
15 views

Asyncronous Rachet tree: How user movability is handled is the Rachet tree being recreated?

As I have read the latest state of art in group key agreement is the Asyncronous Rachet Tree. But in applications like IRC that exists high user movability (users join in ans leave the room). Is ...
1
vote
1answer
93 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
2
votes
1answer
36 views

mDP kay agreement protocol where z's are found on the step where the common key is generated?

Whilst I was studying the mDP protocol I came across into the following step: Group Key agreement: Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\...
0
votes
1answer
55 views

Key exchange protocols non-reducible to groups

Some questions I have ended up wondering about while reading through many of key-exchange protocols are: Is there an intrinsic reason, why most key exchange protocols use group-based approaches apart ...
4
votes
0answers
60 views

IND-CCA2 post-quantum key exchange

QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems. I am looking for a post-quantum key exchange algorithm with the following ...
1
vote
1answer
135 views

Signal Sender Keys: Why it works and which is the common key at the end?

As I has read upon "WhatsUp Encryption Overview" when a client receives a sender message then it performs the following actions: Decomposes Sender Message to ...
1
vote
1answer
90 views

Tls protocols: is the simple diffie hellman key exchange still used these days?

Or did it mostly get replaced by ecdh for key exchange and rsa for authentication ?
2
votes
0answers
42 views

Proving the lack of Perfect Forward Secrecy

In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided. Is there any way to prove or justify this? I couldn't ...
3
votes
1answer
107 views

Post-quantum X3DH

I was trying to look into weather or not it would be possible to build a post-quantum version of the signal protocol. The double ratchet algorithm is trivial to modify, replacing the ECDH key ...
0
votes
0answers
35 views

Are there any key exchange algorithms with high failure rates (i.e. Alice and Bob often have to try multiple times to establish a common key)?

I am wondering if there are any key exchange algorithms which have a very high failure rate in the sense that there is in the neighborhood of a 50 percent change or so of establishing a common key per ...
3
votes
2answers
118 views

challenges in quantum key distribution

Quantum key distribution (QKD) promises unconditional security in data communication and is currently being deployed in commercial applications. Nonetheless, before QKD can be widely adopted, it faces ...
3
votes
1answer
60 views

Secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent

Are there any secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent? This would be useful for many ...
1
vote
1answer
67 views

Why use a date-dependent substring of a pre-shared key instead of just the key?

I've recently come across a situation where one system passes an encrypted payload to another system. The payload is encrypted using a pre-shared key. However, instead of just using the key itself, a ...
1
vote
2answers
107 views

Multiparty key exchange for end-to-end encryption

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
1
vote
1answer
53 views

Signal/TextSecure multiparty Chat. Does the protocol transmits a symmetric key?

As I look over the TexSecures specifications for multi-party chat I have noticed this. Also as far as I understood in TextSecure (now known as Signal) the minimal steps required to do a secure ...
2
votes
1answer
47 views

Does a key exchange protocol with mutual authentication which does not provide forward secrecy can be proven secure in Bellare-Rogway model?

Is forward secrecy a necessary security property for a AKE protocol to be proven secure in Bellare-Rogway model? Is freshness also a necessary security property for a AKE protocol to be proven secure ...
1
vote
0answers
27 views

Nature of risk(s) from KeeChallenge XML file stored in cloud at Onedrive

As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store ...