32

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and sends $$C_2 = C_1 \oplus BRB = key \oplus ARB \oplus BRB$$ Alice calculates $C_2 \oplus key \oplus ARB = key \oplus key \oplus ARB \oplus BRB = BRB$ Alice knows $...


3

It is not known that knowing $g^{x^2}$ would help in any meaningful way to solve the discrete logarithm problem. What you are describing can be generalized to asking whether in a group $\mathbb{G}$ giving an attacker $$(g, g^x,g^{x^2},\dots,g^{x^q})$$ for some $q$ and a uniformly chosen $x \in |\mathbb{G}|$ makes it feasible to recover $x$. It is generally ...


1

According to Wikipedia (with two articles sourced): Computing the discrete logarithm is the only known method for solving the CDH problem. But there is no proof that it is, in fact, the only method. It is an open problem to determine whether the discrete log assumption is equivalent to the CDH assumption, though in certain special cases this can be shown to ...


1

Key exchange algorithms attempt to protect against eavesdropping. You have to assume what you send over the wire (C1, C2, and C3) are intercepted. That's a problem with the method because C2 is simply C1 xor Bob's random bytes and C3 is simply the key xor Bob's random bytes. An attacker with C1, C2, and C3 could take C1 xor C2 to get Bob's random bytes, ...


1

Diffie Hellman Key Exchange The assignment $y\overset{s}\gets{\mathbb{Z}_q}$ generates a random 48 bytes value (no idea what $s$ and $q$ are here) which remains private secret for the server throughout the whole handshake. The server users a DH group of its liking with generator $g$ and modulo $p$ and calculates $Y\gets{g^y} \mod p$ for its public key and ...


Only top voted, non community-wiki answers of a minimum length are eligible