# Tag Info

One of the biggest issues of fixed Diffie Hellman is the total lack of forward secrecy and less randomization. Lack of randomization makes it vulnerable to replay attacks but randomization can be introduced by using nonces and using something like e.g. $KDF(masterkey,nonce1\| nonce2)$ as session key. Remember that two sides will always share the same $... 2 The idea of an "extractor" is common when speaking of "knowledge" in cryptography. This is because it is difficult to formally define what it means to "know" something. So we define it to mean that if someone can create a valid proof of knowledge, we could somehow "look inside" that process and extract the knowledge. ... 1 If we look at the references paper 11, all will be more clear and this is how we read papers; by looking at references. Abbreviations DHA : Diffie-Hellman assumption SDHA-1: Strong Diffie-Hellman Assumption -1 Assumptions 8 is about what KEA1 talks about; (SDHA-1). With proposition 9 it is shown that under SDHA-1, DHA holds ( SDHA-1$\implies$DHA). KEA-1 ... 0 In the TLS protocol, the server decides on the group for the key exchange: finite-field Diffie-Hellman group or elliptic curve. The server must choose within constraints given by the client. In TLS 1.3, groups are identified from a small list of standard groups. Earlier versions of the protocol allow the server to describe a custom group. For elliptic curves,... 1 Would it be possible for a recent desktop CPU to decrypt traffic in (nearly) realtime? If you're asking specifically about backdoored DH groups, well, if you're using a version of TLS that allows the server [1] to propose a nonstandard DH group (and the client would accept that group; sane ones wouldn't), then yes, it could propose an extremely weak group (... 1 Thank you for your comment. I have solved the problem. The solution is given below. 0 Although mathematically Koblitz curves are a few bits weaker than random curves, in a context of elliptic curve cryptography of 256+ bits, those differences are innocuous, I would say, it's safe. X25519 curves are fast, but not as secure as P-256, I think you are in a good track, Best regards 2 The TLS 1.3 handshake works as follows: The client will send a "ClientHello" data structure to the server. At this stage, the client does not yet know which "Groups" the server supports. To avoid an extra round-trip to the server, it can speculatively contain a "group element" for the group it would prefer to use. In the case ... 0 The group is that used in X25519 key exchange, which uses DJB's (Daniel J. Bernstein) Curve25519. There is a series of commercial standards known as SEC#* (Standard for Efficient Cryptography) specifying elliptic-curve cryptography. Public keys (points) in these standards are either 2x+1 (uncompressed x-y coordinates with a header byte) or x+1 (compressed x ... 1 Terminology is important here. A cryptographic salt's main purpose is to secure passwords during reuse and avoid hash pre-computation. So yes, that provides your domain separation. But your question is about randomness extraction from arbitrary sources i.e including devices. NIST's SP800 90B "Recommendation for the Entropy Sources Used for Random Bit ... 1 Let suppose$\mathcal{B}$knows how to compute$g^{x(a+b+c)}$, and I want to solve the cdh challenge$(g,X,Y)$, (we will interpret$X$as$g^x$and$Y$as$g^b$) we choose scalars$d,e$which correspond to$(a+b)$and$(b+c)$and we compute$Z=\mathcal{B}(X, g^d\cdot Y^{-1}, Y, g^e\cdot Y^{-1},X^d, X^e )$. We return$\frac{X^{d+e}}{Z}$. Proof:$DLog \left(\...