8

Knowing the base point, wouldnt it be possible to create some kind of rainbow-table and thus crack some connections? If you could create such a rainbow table that allows you to compute discrete logs of random values to a base $G$ with nontrivial probability $p$, then you can solve the discrete log to any base (with work that takes an expected $O(1/p)$ time. ...


5

In order for Diffie-Hellman to be extra secure we must use a safe prime which is (p – 1) / 2 will also be a prime. We don't have to; there are other options which achieve the same effect. However, it works. so my question is what extra benefit of using such a prime, what's new does it bring to the table. Well, a lot of the security of DH depends on the ...


4

The danger of revealing results in protective coordinates is pointed by David Naccache, Nigel P. Smart, and Jacques Stern's Projective Coordinates Leak, in proceedings of Eurocrypt 2004. As noted in comment, a concise re-exposition is in section 3 of Alejandro C. Aldaya, Cesar P. García and Billy B. Brumley's From A to Z: Projective coordinates leakage in ...


3

Elliptic Curve Integrated Encryption Scheme (ECIES) is a type of Integrated Encryption Scheme (IES) that uses Elliptic-Curve Diffie-Hellman (ECDH) key agreement to establish an ephemeral data key (rather than a session key) which is then used to encrypt data using a symmetric scheme. It uses an ephemeral key during the creation of the ciphertext, for which ...


2

While it's technically not (probably) an issue, you should definitely avoid sharing keys between different purposes. RSA uses separate keys for signing and encryption, for example, since an encrypted-and-signed message would cancel out. RSA only signs a hash of the original message, negating this issue, but it still avoids sharing keys because it's simply ...


2

The linked paper is not about Elliptic Curves which relies on additive groups. It is about the multiplicative groups. For both of them the discrete logarithm is defined. There are common notations that confuse people about them. In the multiplicative version, the division is actually not a division like in the reals. It is the inverse in the group and ...


1

Your alternate method has an expensive public key operation for each push message. While the first protocol does a key exchange just once per subscription and then continues with a symmetric key. If in the key exchange both sides authenticated themselves (Or at least the Application) the user can rely on this, if authenticated encryption is used it still a ...


1

I've always used it as #1. Hyperledger Ursa has an implementation in Rust (see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs). However, it is a type of group signature which allows the type of signing of multiple messages. When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://...


1

The Decisional Diffie-Hellman assumption, on which the key-exchange would be based on does not hold in $\mathbb{Z}_q^*$. The reason is that the Jacobi symbol "leaks" information about the shared key. Therefore one, instead, works with the subgroup of $\mathbb{Z}_q^*$ of order $p$, which is intuitively obtained by "quotienting out" this ...


Only top voted, non community-wiki answers of a minimum length are eligible