Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
441 questions
2
votes
1answer
77 views
Other than an exponent greater than 1, what are the considerations when creating a random 256-bit private key using Diffie Hellman?
Let's assume that I choose the bits for my 256-bit private key exponent by flipping a coin 256 times.
Are there any other issues, besides the randomness of the 256-bit private key to consider? For ...
4
votes
1answer
129 views
+50
Complete Attack on RLWE Key Exchange with reused keys, without signal leakage
I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme.
I am unable to ...
2
votes
1answer
61 views
SIDH: key agreement - why does it work?
In SIDH both parties agree on the key in following way:
Alice calculates a kernel $R = mPB + nQB$
Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
She uses $\...
0
votes
0answers
43 views
Can I use XOR to establish a longer shared secret?
SIKEp434 can only be used to encapsulate a 16 byte (128 bit) shared secret key. Most encryption algorithms these days (specifically (X)ChaCha20) require a 256 bit key to be secure, especially in a ...
1
vote
0answers
43 views
From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure
I have to solve this exercise and I really could use some help:
Show that any 2-round key-exchange protocol (that is, where each party
sends a single message) satisfying $Definition$ $9.1$ can be ...
0
votes
1answer
35 views
Key exchange without an underlying semigroup
I am wondering whether there is a general reformulation of perfect forward secrecy for 2 party key exchange in 2 messages using semigroups. I am looking for references, which would discuss such ...
2
votes
1answer
43 views
Generate a per data shared secret vs per session
I have read about SSL that they persist the shared-secret for the entire session. However, someone in stackoverflow suggested a way of generating a shared secret for each data to send and then send ...
0
votes
1answer
36 views
How to prevent Public Key from being replaced entirely?
I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the <...
0
votes
2answers
151 views
What is the difference between forward secrecy and key freshness?
Is all random private key that generating a unique session key is both forward secrecy and key freshness?
3
votes
1answer
79 views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
0
votes
1answer
45 views
Diffie-Hellman and secret key size
How can one guarantee that the generated DH secret key is of certain length? Say 256bit. Actually, prime length is not enough since the remainder of the last process, the modulus, may result in too ...
0
votes
0answers
40 views
Decentralized / Distributed Private Key Generation between Untrusted Parties?
I found an interesting concept in this paper, page 13, (Link to the paper) called "Decentralized private key generation", as follows:
"Decentralized private key generation – Multiple Enigma nodes ...
0
votes
0answers
30 views
How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]
In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
1
vote
1answer
36 views
Can I do a forward secure half-round ephemeral-static ECDH?
In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:
ECC key pairs for open ID
...
1
vote
0answers
63 views
If 1 can be a random number in Diffie-Hellman Algorithm
I've done some calculations and Diffie-Hellman Algorithm worked for all chosen random numbers except $1$. In the description of the algorithm, I can't find information that the random number has to be ...
3
votes
1answer
96 views
How does the key agreement process take place in Virgil E3Kit SDK for end to end encryption?
I'm using Virgil E3Kit SDK to implement end-to-end encryption in my App. Their E3Kit SDK is very effective and not too hard to understand, but I still don't understand how does the key agreement ...
1
vote
1answer
85 views
When do clients use TLS in PSK mode?
The TLS protocol can perform the handshake in different modes. Either fresh handshake where new keys are generated, or using Pre Shared Keys (PSK) or what was know as Session Resumption in previous ...
3
votes
1answer
376 views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
1
vote
1answer
124 views
Key-Exchange in Steganography
I know there are key-exchange methods in Cryptography. But in case of Secret-key Steganography, what actually stego-key means and how can we use the key and once used how we exchange that with the ...
7
votes
0answers
87 views
Differences between “NewHope” and “NewHope-simple”
The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
2
votes
0answers
38 views
Key confirmation and other benefits of double ratchet
I'm trying to understand a comment from the Signal blog post Advanced cryptographic ratcheting.
This article uses the term OTR ratchet to refer to a simple asymmetric DH ratchet, where Alice ...
3
votes
2answers
97 views
In Diffie-Hellman, are $g$ and $p$ universal constants or are they chosen by one party according to a set of rules?
I can't find any clarity on this. In textbooks, what I'm reading suggests there's already a standardized $g$ and $p$ that everyone uses, but I can't find what they are.
The closest I've come to is ...
1
vote
1answer
49 views
Diffie-Hellman: Recommendation of the base size?
Based upon choosing a prime $p$ of recommended length and $N=2p+1$, where $N$ is also prime, and $a^2$ is not congruent to $1 \pmod N$, and $a^p ≡ 1 \pmod N$, I believe you can rely upon $a$ as having ...
0
votes
0answers
34 views
Two-party symmetric key establishment protocol
I need a symmetric key protocol that will mutually authenticate and establish a new short-living session key between two parties that have a pre-shared key. Unfortunately, I have not found any ...
0
votes
1answer
97 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
1
vote
0answers
46 views
Reason for including the public key of the key agreement in the KDF
I found the following text when looking up KDFs:
In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter.
...
6
votes
3answers
325 views
Formal description of KDF1 and KDF2
I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
0
votes
1answer
87 views
Burmester Desmedt Key agreement. Is the division a floating point one or an integer one
As I look upon Burmester Desmedt algorithm:
I notice that the intermediate key $K_i$ is getting calculated as:
$K_i=(k_{i+1}/k_{i-1})^{x_i} \mod p$
Thus I wonder wheher the division $k_{i+1}/k_{i-1}...
1
vote
1answer
115 views
What happens if we choose the random secret keys in Diffie-Hellman greater than prime?
Diffie-Hellman works as follows:
Given public parameters $p$ (a large prime) and $g$ (always referred to as a generator of $(\mathbb{Z}^∗_p)$. Then:
Alice randomly chooses $a<p$ and sends $A\...
2
votes
1answer
65 views
Protocol that generates keys every 2 minutes using KDC
I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same
key, I want to renew the session keys ...
1
vote
1answer
66 views
Can you construct a key agreement system from public-key-encryption system?
Can you construct a key agreement system from public-key-encryption system? If so, how?
What about vice versa?
0
votes
0answers
36 views
Most energy-efficient authentication protocol?
I am looking for a cryptographic protocol that is as energy-efficient as possible. I am talking about battery drain. Alice wants to do a mutual authentication with Bob. Maybe symmetric is good, maybe ...
0
votes
0answers
60 views
Burmester Desmedt confused on the last step
I try to implement in code the traditional burmester desmedt algorithm for group key agreement:
But I have the following question regarding the last step:
$K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
1
vote
0answers
47 views
Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0
In the original mDP protocol once all $z$ values received from each participant the following calculation is being done:
If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then ...
0
votes
0answers
23 views
Which Auxiliary Hash Function to use for Pointcheval's mDP protocol
I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
0
votes
0answers
68 views
Sharing secret content with multiple recipients
I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email.
I am no expert in crypto ...
0
votes
0answers
52 views
Simple but secure method to share secret (128 bit AES key) though an untrusted relay
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
1
vote
0answers
72 views
Security of the Needham-Schroeder public key protocol after a minor adjustment
I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:
We have the Needham Schroeder Public Key Protocol:...
7
votes
2answers
693 views
Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?
By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN:
It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
0
votes
0answers
12 views
Production Ready Message Format Standart for Key agreements on top of XMPP
Greedings,
I try to run group key agreements on top of XMPP thus I want somehow a production used message format for key agreement. As far I found theese:
XEP-0384: OMEMO Encryption
XEP-0102
But all ...
3
votes
1answer
120 views
Is OAEP needed when encrypting a session (random) key using RSA?
My question is two parts:
when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
0
votes
2answers
91 views
Is it possible to get different plaintexts from a single ciphertext using different keys?
Suppose to have a chipertext that you can't decrypt, but you know that the plaintext can be A, B or C. Then arrives to you the key which is used to encrypt the chipertext.
You can decrypt the ...
6
votes
1answer
159 views
Why would the use of Curve25519 in Dragonfly leak information?
An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote:
One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
1
vote
1answer
370 views
How does Dragonfly key exchange work, in non-white-paper terms?
I'm trying to understand WPA3, whose Simultaneous Authentication of Equals is supposedly similar to Dragonfly Key Exchange.
Dragonfly is resistant to dictionary attacks, meaning that rather than an ...
1
vote
1answer
167 views
Why does DH-EKE require that public keys be indistinguishable from random?
The introduction to SPAKE pre-authentication states:
Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman ...
3
votes
1answer
159 views
In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?
According to KeyCDN, TLSv1.3 connections are established in a single round trip:
While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip
If ...
0
votes
1answer
43 views
Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages
Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the ...
1
vote
0answers
69 views
Simulatability of Diffie-Hellman Key Exchange
While reading through Shoup's paper on provably secure Diffie-Hellman key exchange (DHKE), I do not understand something rather simple.
There are two parties $A$ and $B$. $A$ starts by sending $g^a$, ...
2
votes
2answers
253 views
Curve25519 Key Exchange Bit Security
Please note I am new to Cryptography in general. Sorry if I do not use the correct terminology/my question has some fundamental flaw.
Alice and Bob want to communicate securely over an insecure ...
6
votes
2answers
334 views
Do standalone Oblivious Transfer (OT) Protocols exist?
Are there any Oblivious Transfer (OT) protocols that don’t rely on asymmetrical encryption, public-key encryption or key-exchange?
I’m starting to wonder, as all the OT protocols I know of (and can ...
