Questions tagged [key-exchange]
Key exchange protocols allow two parties to produce a secret session key over a public channel.
588
questions
0
votes
2answers
78 views
How can I dentify the ECDHE group value used in a TLS session
In ECDHE, the group is a public value.
I want to get this value for a session. I inspected the session using Wireshark.
Under the ServerHello -> Key share extension -> Key share entry, I found ...
0
votes
1answer
61 views
Is the Key Exchange authenticated and confidential?
I have made a private messaging program and would like to check that nothing is stupid in my use of cryptography.
I am an amateur and nothing is for production.
I thank you in advance.
The message ...
0
votes
1answer
51 views
Deterministic key selection using iterative value comparison - how dumb was this?
Just to start, this is mainly a curiosity question that's been nagging me for a while. I did a fair bit of googling to see if someone has already performed a righteous expose of this silly idea, but ...
0
votes
1answer
75 views
How are the cipher, the key and the initial message (that is not encrypted) are releted?
Suppose that $m$ is a message that someone player $i$ wants to send to a network of other players $j\neq -i$. The player to prevent his message from cheating by others uses an encyrpstion scheme. Say $...
0
votes
0answers
38 views
How to use ffdhe2048 in node js?
I am reading about Diffie Hellman key exchange from Real World Cryptography book and came across this
For this reason, best practice nowadays is to use RFC 7919, which defines
several groups of ...
0
votes
1answer
72 views
Is it secure to use RSA to exchange AES key?
I have to create a Client-Server Application using Java and I want to make the communication secure. I thought to use AES to encrypt the messages and for key exchange I make the next steps:
Client ...
1
vote
1answer
73 views
Asymmetrically encrypt a short message into a short string
I have a string whose size is < 32 characters from the following limited character set.
uppercase and lowercase Latin letters: A to Z and a to z
digits: ...
0
votes
1answer
48 views
Where can I find good practice questions for proofs by reduction?
I already have the Katz-Lindell textbook, but I also want some additional practice problems for security reductions for stuff like PRFs, MACs, digital signatures, private and public key schemes, and ...
2
votes
2answers
74 views
*-LWE equivalent of Diffie-Hellman $g^{x^2}$ vulnerability
In Is Diffie-Hellman less secure when A and B select the same random number? , the possibility of Diffie-Hellman key exchange producing identical peer keys and the vulnerability of it against passive ...
0
votes
1answer
35 views
Encrypted data sharing in decentralised system
Alice encrypts file using her public key and upload it to decentralised file store (some service). Bob buys access to the file. Is it possible to share decrypted file with Bob without having Alice's ...
1
vote
0answers
29 views
Is Diffie-Hellman less secure when A and B select the same random number? [duplicate]
I understand that it is feasibly impossible for A and B to select the same random number, given the large input space, but what if it does happen? Does it effect the security of the key exchange? Can ...
3
votes
3answers
1k views
How to interpret my professor's statement about "seed" and "symmetric-key encryption"?
In the cryptography course, the professor said that:
these days for symmetric key encryption, instead of sending out the key, Alice sends the seed to Bob, and then based on that Bob can get the key.
...
0
votes
1answer
36 views
Simple Key Exchange, One Server
I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
0
votes
1answer
57 views
Are all public key a result of computing g^k mod p
I just read through the text book definition of Diffie–Hellman key exchange. And from what i understand, the public key that is shared based on the protocol is calculated from:
...
1
vote
1answer
59 views
X3DH and key exchange between Alice identity key and Bob pre signed key (DH1)
I'm getting familiar with Signal key exchange phase and as far as I understand all 3 exchanges between Alice ephemeral key and all of Bob keys from the bundle, I have some thoughts about key exchange ...
2
votes
0answers
23 views
SSL/TLS Forward secrecy with 2 KEM public keys
As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s).
An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
0
votes
0answers
36 views
Fast key exchange algorithm in hardware with small key size
Which asymmetric algorithm will be best only for key exchange to set up communication using symmetric cryptographic algorithm. Comparison should be in term of speed, key length and their hardware ...
1
vote
0answers
41 views
Combining Post-Quantum and Classical KEM
I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
4
votes
1answer
56 views
Secret sharing such that all shareholders obtain access to the secret (one shareholder can't just run off with the shares)
Say, using something like Shamir's polynomial scheme, you split a secret $x$ among $n$ people (each given a "share" of the secret) such that you need all $n$ shares to recover the secret.
...
6
votes
4answers
464 views
A source of randomness that anyone can independently, conveniently and robustly access?
Does there exist a source of randomness that anyone in the world can independently, conveniently and robustly access?
For example, the 10th decimal place of the temperature in Mexico City is ...
1
vote
2answers
95 views
Verifying result of (EC-)Diffie-Hellman
I received a public key by JSON.
For the example, I have 4 keys: 2 public keys and 2 private keys.
...
3
votes
0answers
109 views
XDH vs DH and ECDSA vs EDDSA
I am new to security area. I came across mutiple words I can't understand and there is little infomration I can get from google.
What is XDH/XEC, is the X means 'enhanced'? Are they just have a ...
3
votes
1answer
99 views
Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
1
vote
1answer
28 views
How to calculate a common encryption key between sender and receiver
In the picture below, for the text underlined in red color: 7X(MOD 11) = 72(MOD 11) =49(MOD 11)
My questions are:
(1) obviously there is no equal relationship between 72(MOD 11) and 49 (MOD 11), and ...
1
vote
1answer
47 views
What can I use for key exchange?
I am trying to send AES keys from one computer to another, but I need to provide some form of attestation of the key's provenance. How should I go about doing this?
1
vote
0answers
20 views
CK vs BR Key Exchange Security Models
I'm writing a paper on Authenticated Key Exchange Protocols. I've read Bellare and Rogway's seminal paper on the subject and I think I understand BR Model and I'm now reading Cenetti and Krawczyk's ...
0
votes
1answer
42 views
What are the explicit usage of different keys derived from SKEYSEED in IKE?
We have seven different keys derived from DH key and nonces via PRF in IKEv2 as skd, skai, skar, skei, sker, skpi, skpr. Why different keys are generated for initator and responder for encryption? ...
0
votes
1answer
73 views
Why pre-shared key is not involved to key derivation in IKEv2?
In IKEv1 (RFC 2409), preshared secret is involved to key derivation where IKEv2 (RFC 7296) use it for only authentication. When we consider post-quantum security, this property makes IKEv1 suitable if ...
3
votes
1answer
42 views
SIDH: What if the two kernel generators are chosen in the same torsion group?
In SIDH, either party chooses its secret point $R_A = [m_A]P_A+[n_A]Q_A \in E[\ell_A^{e_A}]$, $R_B = [m_B]P_B+[n_B]Q_B \in E[\ell_B^{e_B}]$ from two different sets $E[\ell_A^{e_A}]$ and $E[\ell_B^{e_B}...
0
votes
1answer
76 views
When is a PQ key-exchange algorithm suitable for use with long-term static keys?
I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key.
I read this comment that SIDH is only good for ...
0
votes
0answers
18 views
Can Merkle signatures be leveraged for key exchange?
A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
1
vote
1answer
56 views
Under which conditions certificate is required for IKEv2?
In IKEv2 document, there are expressions as [CERT,] or [CERTREQ,] in the parts of IKE_SA_INIT or IKE_AUTH exchanges. In this notation brackets indicates that it is optional. I didn't see expressions ...
0
votes
1answer
84 views
Method to mitigate MitM attack for DH key exchange
Plain DH key exchange protocol is vulnerable to MitM attack. I checked the SRP (RFC 2945) but did not fully understand why it can help. I thought of a fix to mitigate MitM problem by using a pre-...
0
votes
0answers
39 views
Why do you need to apply hash over DH shared key? [duplicate]
I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
1
vote
0answers
59 views
How to decrypt raw TLS bytes?
Is there any tool / way to decrypt raw bytes of a TLS 1.2 session, when the master key is known, even if forward secrecy is used?
The closest I found is this.
I know its possible using Wireshark, but ...
4
votes
1answer
111 views
What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?
This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results.
As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
45 views
Comparing Diffie Hellman and EC Diffie Hellman sizes
So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the ...
2
votes
1answer
54 views
Intuitive explanation for key exchange with public/private keys
I want to teach some people about crypto basics, and one of the topic will be key exchange with a public and private keys.
The audience is made of people working in InfoSec, but mostly junior fresh ...
2
votes
1answer
97 views
What does DH(IPKa, IPKb) notation mean? Diffie-Hellman confusion
I'm trying to implement X3DH (extended triple Diffie-Hellman) in a network of mine.
The way I understand it, a bundle (IPKb,SPKb,OTKb) is retrieved by Alice from Bob, through the server, and
using her ...
3
votes
1answer
68 views
Is the following PAKE protocol UC secure?
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
1
vote
1answer
63 views
what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
0answers
36 views
Does IND-CPA to INC-CCA effects on the error probability?
If we have a key encapsulation mechanism (KEM) that is IND-CPA secure, with some error probability $P_e$ (probability that the shared keys are not equal).
The goal is to use the Fujisaki-Okamoto ...
0
votes
1answer
33 views
AKE using Noise_NNpsk2 vs Noise_NKpsk2
I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward ...
1
vote
0answers
57 views
How efficiently can an attacker forge parts of a fingerprint?
If two devices do not trust each other yet, you can't simply send the correct fingerprint across: you have to manually verify it. I am looking into the security of comparing only random parts of a ...
1
vote
0answers
49 views
Simple description of a multi-party fair exchange protocol with trusted third-party
Imagine Alice wants to sell a file with important information to Bob for money. The file must be encrypted, so nobody can eavesdrop. It must also be signed upfront, so Bob knows it has not been ...
1
vote
1answer
98 views
Is there any standard present to measure strength of a generated key using true random number generator?
I was wondering how to measure the security strength of a generated secret key for the below protocol:
"A 128 bit random number is generated by TRNG and the random number will be used as a ...
-2
votes
1answer
116 views
Finding Diffie-Hellman secret key with only some know values [closed]
I currently have the following information and I assume the first line separated by the: represents the prime number and generator. Is there any way I can find the secret key shared for the Diffie-...
0
votes
0answers
31 views
In group key agreement/exchange protocols, does key independence implies forward and backward secrecy?
Kim et al. [here] define Foward and Backward secrecy as follows:
Forward Secrecy (not perfect foward secrecy): the inability for a passive attacker to obtain past group keys from a subset of new ...
2
votes
1answer
63 views
What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?
From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf
The 8192128 parameter set is bigger, but the ...
1
vote
0answers
76 views
Dragonfly masked DH
I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
