# Tag Info

14

Kindly, let me know what was the actual problem which leads us to use groups in cyptogrpahy? Well, we use groups and other similar mathematical constructs because: We found there are problems that appeared to be difficult to solve with those groups We found ways to translate the difficulty of solving those problems into the cryptographical strength of ...

13

(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports, Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in 1.3. This currently includes not only the groups from RFC 8446, but possibly more recent RFC as well, such as Brainpool curves from RFC 8734. The TLS supported ...

9

$y^2 = x^3 + ax + b\bmod p$ is the Short Weierstrass equation. The theory behind it is here Using Bezout’s Theorem, it can be shown that every irreducible cubic has a flex (a point where the tangent intersects the curve with multiplicity three) or a singular point (a point where there is no tangent because both partial derivatives are zero). [Reducible ...

8

The responsibility of the user of Curve25519 for DHKE is Section 3; The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte. This is a guarantee that the legitimate users ...

8

Groups have properties which are useful for many cryptographic operations When you multiply 2 numbers in a cryptographic operation you want the result of the multiplication also to be in the same set. For e.g. if you are multiplying something which fits in a byte (or n bytes) by something similar, you also want the result also to fit in a byte (or n bytes). ...

7

Yes it is. It can be formally reduced to the hardness of the decisional square Diffie-Hellman assumption, which states that distinguishing $(g,g^a,g^{a^2})$ from random is hard (this is a well established assumption). It follows in a relatively simple way from the answer I wrote here to a related question. I can let you work out the details in case you want ...

6

Yes, those are the 5 Elliptic Curves groups that are currently supported for ECDHE and 5 Finite fields for DHE. If you want compliance with the TLS 1.3 standard, those are the only ones. DHE is losing its ground to the ECC version since ECC is faster. If you insist to use DHE the use a field size larger than 2048. one discussion into what curves should be ...

6

There is no point multiplication operation on secure elliptic curves*, there is only scalar multiplication apart from the point addition of the group. Scalar multiplication Scalar multiplication with a scalar $t$ is adding a point $P$ it self $t$-times $$[t]P : = \underbrace{P + P + \cdots + P}_{t-times}$$ and it is well defined operation since the group is ...

6

Usually the result of the (Elliptic Curve) Diffie-Hellman calculation is called a master secret. This master key is commonly used as input keying material (IKM) for a Key Derivation Function (KDF). Using the KDF multiple keys can be derived from the master secret. What you are looking for is called "key conformation". There are various ways of ...

5

Is it possible for Carol to find Bobs key in $S_{pks}$ This is a decisional Diffie-Hellman problem. We can summary this problem as: "we're given the values $G, aG, abG$, and a series of values $c_1G, c_2G, ... c_nG$, can we recognize $c_iG = bG$" We can reword the problem as "assuming $H = aG$, we're given the values $H, (a^{-1})H, bH$, can ...

4

Arnaud asked me to clarify this issue. It is true that one should use an authenticated encryption mode or encrypt-then-MAC, and the paper says that explicitly. Indeed, the explanatory text in the paper following the figure shown above (Section 5.2 of https://webee.technion.ac.il/~hugo/sigma-pdf.pdf) addresses this issue. It says: We stress that the ...

4

In the case of Diffie-Hellman Key Exchange (DHKE or DH) in the multiplicative group $\mathbb Z_p^*$, the recommendable practice is to pick a prime $p$ and generator $g$ from RFC 3526, which gives these parameters for bit size $k$ of $p$ in $\{1536,2048,3072,4096,6144,8192\}$. These $(p,g)$ obey the criterion below: $p$ is a prime such that $q=(p-1)/2$ is ...

4

Is there a name for (what I so presumptuously) called Cyon ECIES? No. Though it comes close to how crypto_box works: Using static Diffie-Hellman with extra randomness. Is Cyon ECIES safe? Yes, it should offer about the same security as any other static Diffie-Hellman based encryption scheme with extra randomness. Taking a step back - are there any other ...

4

I think you got it backwards: Algebraic structures like rings and groups and fields are the underlying concept of all commonly used types of numbers like the integers, rationals, reals and complex numbers. In algebra it is quite common to do theorems and proofs in the structure with the minimum requirements - so they are valid in a wide range of structures, ...

4

The problem with "why" "Why" is generally an unfortunate question. It is often very hard or impossible to answer. The reasoning goes like this: if you ask "why" a (reasonably complex) thing is like it is, any meaningful answer usually breaks the issue down into subcomponents. Then, you can and need to ask "why" for ...

4

My question is, are all public/private key generated to have this relationship? No; DH does that, but there are other public key algorithms do something different. With RSA [1], the public key is a pair $n, e$, while the private key can be represented as $n$ and a value $d = e^{-1} \bmod \text{lcm}(p-1, q-1)$ (where $p, q$ are the prime factors of $n$. As ...

4

The Diffie-Hellman key exchange is an asymmetric algorithm that is used to establish a symmetric key. In general asymmetric cryptography is when the communicators have access to different secret information and symmetric cryptography is when they have access to identical secret information. Symmetric cryptography is a less stringent model and so is typically ...

3

Are "private keys" in the context of diffie-hellman refer to the private $a$ and $b$ that Alice and bob privately select respectively? Yes, correct. Similarly, $A=g^a\bmod p$ and $B=g^b\bmod p$ are also called the "public keys". What is considered an exchange? A session of information exchanging between to parties? An exchange is an ...

3

By Multi-Prime DH, I assume you mean something analogous to Multi-Prime RSA. In Multi-Prime RSA, we pick a modulus with three (or more) prime factors; because the holder of the private key knows the factorization, he can compute (using the CRT optimization) using smaller prime modulii (and smaller exponents), yielding a moderate speed-up. Given that is what ...

3

You can see the list of all supported groups at the IANA, which tracks all of the assigned code points. There are many more items than are listed, although they aren't available in TLS 1.3. In general, what you should use depends on (a) what security level you want to have, (b) what your software and hardware support, and (c) what your performance ...

3

One possible statement of the Discrete Logarithm Problem modulo prime $p$ (the one used in practice in DSA, and more generally when working in a Schnorr group) goes: given large random prime $q$, very large prime $p$ with $p-1$ a multiple of $q$, integer $g$ of order $q$ modulo $p$ (equivalently, such that $g^q\bmod p=1$ and $g\bmod p\ne1$ ), $a$ obtained ...

3

when the client send something to the server it will be encrypted with the server's public key (so only the server can decrypt it) and vice versa (when server has to send something to the client it will be encrypted with the client's public key) As I understand it, you are suggesting not to bother using symmetric encryption; instead, have both sides ...

3

To extend kelalaka's answer, if $p$ is a safe prime (that is, if $p = 2q+1$ with $q$ prime), then: If $p \equiv 7 \pmod 8$, then the order of $g=2$ will be $q$ If $p \equiv 3 \pmod 8$, then the order of $g=2$ will be $2q$ If $p = 5$ (the only other possibility), then the order of $g=2$ is 4 (that is, $2q$)

3

Generally, named curves are used for DH and servers don't generate parameters themselves. These are configured using a specific number in the TLS protocol. The keys on the other hand are always re-generated preferably for each connection for TLS. This is assuming that an ephemeral key exchange is used, which can be identified using the postfixed letter E in ...

3

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. I don't believe that is correct; a postquantum Key Encapsulation Method (KEM) would appear to be the natural replacement for DH/ECDH within TLS. In the KEM, one side (the client) produces a KEM public ...

3

On a calculator this gives overflow error, how am I supposed to calculate the public key when a private key is a large number? A standard calculator cannot handle that, and we don't expect it. If you have a programmable one you can use square-and-multiply as in levgeni's answer. This, however, will fail when the calculator cannot handle integers (the ...

3

Maybe I can give another answer from the perspective of Multiparty Computation (MPC), which studies the problem of enabling multiple parties to securely compute a function on sensitive data while revealing only the outputs. A very important tool for solving the problem stated above is secret-sharing, which enables distribution of a secret $s$ into $n$ shares ...

3

As X3DH uses elliptic curve Diffie-Hellman, I'll write things in elliptic curve notation thus if we have a curve $E$ with $q$ points and a base point $G$ we might see Alice choose a private key $a\pmod q$ and create a public key $A=aG$. It should be easy to convert to multiplicative notation if you need to. Regular Diffie-Hellman In the regular form of the ...

3

Lets say I have $g^x \bmod p$ and $g^{xy} \bmod p$. How can I efficiently obtain $g^y \bmod p$? We hope that there is no efficient method (without using knowledge of $x$ or $y$) Here's why: if you can solve that problem, you can solve the (computational) Diffie-Hellman problem; here's how: Suppose that you did have an Oracle that, given $g, g^x, g^{xy}$, ...

Only top voted, non community-wiki answers of a minimum length are eligible