6

The basic baby-step-giant-step algorithm can be tweaked to make use of this information. The following algorithm takes $\Theta(\!\sqrt{k-j})$ group operations. Let $h:=c\cdot g^{-j-1}$, which equals $g^{i-j-1}$. Pick some integer $m\geq\sqrt{k-j-1}$. Initialize an empty lookup table $T$. For all $0\leq a<m$, compute $g^{ma}$ and store $T[g^{ma}]:=a$. For ...


5

Currently we do not think that 512 bit DH is secure. You can look for more secure parameters (i.e. above 1280 bits at the very least) is secure. Secure key sizes can be found at keylength.com. For DH you can e.g. look at the NIST recommendations for "Discrete Logarithm" (the underlying mathematical problem that is the base of DH-based cryptography). Using ...


3

You can do ECDH with more than two parties. See the below adaptation of the wikipedia example for an EC group - The parties agree on the algorithm parameters, a curve over $E(\mathbb{F}_p)$ and base point $G$. The parties generate their private keys, named $a$, $b$, and $c$ (these are integers). Alice computes $aG$ and sends it to Bob. Bob computes $(aG)b = ...


3

How is this done efficiently on the fly for Diffie Hellman? For Finite-Field Diffie-Hellman, you usually pick $p$ such that $q=(p-1)/2$ is also prime. Now Lagrange's theorem tells us that every element's order must divide the group order which is $p-1=2q$. This leaves us with four divisors: $1,2,q,2q$. Once you know that, you can simply test that your ...


2

The problem lies in the trust of the public key. If an attacker can simply replace one of the exchanged public keys with his own then an active MITM attack is possible. The attacker simply replaces both public keys with his own and proceeds to create two channels that rely on the shared secrets. For ephemeral key pairs - as commonly used - the key pairs are ...


2

The answer depends on the attack your are interested in. For passive attackers who are eavesdropping on the exchanging of information, the attacker has to solve an instance of the Diffie-Hellman problem which is believed to be difficult. For active attackers who can tamper with the information exchanging, "textbook" Diffie-Hellman is not safe. To prevent ...


Only top voted, non community-wiki answers of a minimum length are eligible