6

Yes it is. It can be formally reduced to the hardness of the decisional square Diffie-Hellman assumption, which states that distinguishing $(g,g^a,g^{a^2})$ from random is hard (this is a well established assumption). It follows in a relatively simple way from the answer I wrote here to a related question. I can let you work out the details in case you want ...


4

Is there a name for (what I so presumptuously) called Cyon ECIES? No. Though it comes close to how crypto_box works: Using static Diffie-Hellman with extra randomness. Is Cyon ECIES safe? Yes, it should offer about the same security as any other static Diffie-Hellman based encryption scheme with extra randomness. Taking a step back - are there any other ...


4

There is no point multiplication operation on secure elliptic curves*, there is only scalar multiplication apart from the point addition of the group. Scalar multiplication Scalar multiplication with a scalar $t$ is adding a point $P$ it self $t$-times $$ [t]P : = \underbrace{P + P + \cdots + P}_{t-times}$$ and it is well defined operation since the group is ...


3

Generally, named curves are used for DH and servers don't generate parameters themselves. These are configured using a specific number in the TLS protocol. The keys on the other hand are always re-generated preferably for each connection for TLS. This is assuming that an ephemeral key exchange is used, which can be identified using the postfixed letter E in ...


3

By Multi-Prime DH, I assume you mean something analogous to Multi-Prime RSA. In Multi-Prime RSA, we pick a modulus with three (or more) prime factors; because the holder of the private key knows the factorization, he can compute (using the CRT optimization) using smaller prime modulii (and smaller exponents), yielding a moderate speed-up. Given that is what ...


3

In the case of Diffie-Hellman Key Exchange (DHKE or DH) in the multiplicative group $\mathbb Z_p^*$, the recommendable practice is to pick a prime $p$ and generator $g$ from RFC 3526, which gives these parameters for bit size $k$ of $p$ in $\{1536,2048,3072,4096,6144,8192\}$. These $(p,g)$ obey the criterion below: $p$ is a prime such that $q=(p-1)/2$ is ...


3

One possible statement of the Discrete Logarithm Problem modulo prime $p$ (the one used in practice in DSA, and more generally when working in a Schnorr group) goes: given large random prime $q$, very large prime $p$ with $p-1$ a multiple of $q$, integer $g$ of order $q$ modulo $p$ (equivalently, such that $g^q\bmod p=1$ and $g\bmod p\ne1$ ), $a$ obtained ...


2

Are "private keys" in the context of diffie-hellman refer to the private $a$ and $b$ that Alice and bob privately select respectively? Yes, correct. Similarly, $A=g^a\bmod p$ and $B=g^b\bmod p$ are also called the "public keys". What is considered an exchange? A session of information exchanging between to parties? An exchange is an ...


2

Can you please correct me if I am wrong? What you have is essentially correct; however it can be generalized a bit. In real systems that use DH, the honest system will take the shared secret and do something with it; commonly putting it (and some public information that the attacker knows) through a KDF, and then using the keys generated by that KDF to ...


1

RSA keys are generally used for signing and authenticating the key exchange. It is not used for (EC)DH, which uses freshly generated one-time-use public/private key pair for key exchange. The color analogy within DH is to show that if an adversary only has two public keys, it won't be able to calculate the DH shared secret used to derive session keys. This ...


Only top voted, non community-wiki answers of a minimum length are eligible