New answers tagged

7

He [Ed: Eve] then sends his half to Alice signed and establishes a connection. Now Alice is communicating with Eve and Eve is decrypting the message and sending to Bob. Eve can only sign with her own private key. So your attack only works if Alice accepts the signature from Eve. That means that: Eve's public verification key needs to be trusted and that ...


4

In your case, the discrete Logarithm Problem (DLP) is given $a,b,n \in \mathbb{Z}^+$ find $x \in \mathbb{Z}_{>1}$ such that $a^x \equiv b \bmod n$, if such $x$ exists. For the small modulus we can build a table for the DLP problem, or you can stop building the table whenever you find your case. The below is a DLog (Discrete Log) table for modulus 19 ...


3

but does the use of a modulus or are the exponents literally meant to be exponents alone? Well, in SPAKE2+, all operations are done within some finite group, typically either a prime multiplicative group, or an elliptic curve group. If we decide to use a prime multiplicative group, then yes, addition, subtraction and multiplication are all done implicitly ...


0

While MODP groups such as the question's one meet the definition of Schnorr groups (as explained in the other answer), we'd normally not call them Schnorr groups. By analogy, we'd normally not call $42$ a complex number. MODP groups belong to a very special subclass of Schnorr groups: they use $p=2q+1$ with $q$ prime, maximizing the order of $h$ (with that ...


1

For a full symmetric key key transport, the symmetric key is created from a random number generator. This is then signed with the owners static private key and then encrypted with the recipients static public key (key wrapping), and then sent to the recipient. The recipient will receive, decrypt and verify the signature, and the symmetric key is decided on. ...


0

All the key exchange schemes provided by libhydrogen (actually the Noise protocol) are secure against MITM. With the N variant, the client has to know the server's public key, and will not return a valid shared key pair unless the response comes from a server that has the corresponding secret key. If you need the server to authenticate the client as well, ...


3

This was actually the original proposal of Whit Diffie and Martin Hellman back in 1976: Alice puts $g^a$ in the telephone book and keeps $a$ secret, Bob does likewise with $g^b$ and $b$, and whenever Alice and Bob want to have a conversation they use $g^{ab}$ as a shared secret key. The main trouble is that you expose an oracle for $h \mapsto h^x$, where $...


1

(in DH) Bob used a small secret key that can be brute-forced. If the private key is $k$-bit, a meet in the middle attack allows private key recovery with cost $O(2^{k/2})$ group operations (here, multiplication in the modulo $p$ group $\Bbb Z_p^*$). In its simplest form: we know Bob's public key $y=g^x\bmod p$ and want the $k$-bit $x$. We choose $a$ with $\...


Top 50 recent answers are included