Tag Info

This was actually the original proposal of Whit Diffie and Martin Hellman back in 1976: Alice puts $g^a$ in the telephone book and keeps $a$ secret, Bob does likewise with $g^b$ and $b$, and whenever Alice and Bob want to have a conversation they use $g^{ab}$ as a shared secret key. The main trouble is that you expose an oracle for $h \mapsto h^x$, where $... 1 (in DH) Bob used a small secret key that can be brute-forced. If the private key is$k$-bit, a meet in the middle attack allows private key recovery with cost$O(2^{k/2})$group operations (here, multiplication in the modulo$p$group$\Bbb Z_p^*$). In its simplest form: we know Bob's public key$y=g^x\bmod p$and want the$k$-bit$x$. We choose$a$with$\...