New answers tagged

0

That particular $p, g$ values are the standard "group 5" DH parameters (see RFC3526) - there are considered quite strong (even if current fashion is to prefer groups just a bit stronger); attempting to compute the discrete log will be essentially impossible, On the other hand, you might want to compare the listed $p$ and $B$ values; you have likely ...


1

When you use Diffie-Hellman key agreement protocol, both sides reach the equal keys. Then, you can use it with private key encryption methods, not public ones (like AES or one-time-pad). One philosophy of public key encryptions is for avoiding key exchanges or key agreements. They are also called asymmetric encryption methods, because the sender and the ...


2

This contradicts an answer In what sense do they contradict? The first one states that, for a safe prime, we have subgroups of size $q$ and $2q$. The second one states that we typically use a $g$ that generates a subgroup whose size is a prime. These two statements do not contradict each other; combined, that would mean that (to follow both) we select a $...


1

The length of the subgroup produced by $2\pmod{83}$ is $82$. Can you phrase it like that? That would be unusual. At least, "length" should be size (cardinality would be very formal). I would use something on the tunes of: the order of the multiplicative subgroup generated by $2$ modulo $83$ is $82$. $2$ has order $82$, modulo $83$. The previous answer ...


1

Why does this article say that the parties "can't" use $g^{ab}$ until Alice acknowledges? They never want to be in a situation where Alice receives a message she can't decrypt. Key acknowledgment helps prevent this when the messages can be received out of order or even completely dropped. Until Alice acknowledges the advertisement, Bob has no idea that ...


2

Since the generator should be a primitive root of p Well, here's your misunderstanding; the generator $g$ needn't generate the entire group $\mathbb{Z}^*_p$; instead, it can generate a proper subgroup (and in most cases, we select such a subgroup). Here's the issue, if $h$ is a factor of the size of the group generated by $g$, then given $g^x \bmod p$, we ...


3

When using a public prime modulus $p$ (the question's $a$ and $b$), participants to Diffie-Hellmann key exchange choosing secret $x$ do not send $y=p^x$ as considered in the question (which invalidates the reasoning made). Instead, participants send $y=g^x\bmod p$, where $g$ is some public constant. $g=2$ will do (or will often do, depending on variant of ...


1

An interesting cryptanalytic attack on Diffie-Hellman is the small subgroup confinement attack. The attack works if the DH parameters are chosen without caution. Here is a brief explanation on how it works. DH works in multiplicative groups. Say we are working in $Z^*_p$. As $p$ is prime, the order of this group ($p-1$) is composite, therefore by Lagrange's ...


2

The issue is plain and simply: JavaScript sucks. In this particular case the issue is that JS has no integer type, so everything is stored as a double. In particular the last calculation $13^{16}$ would yield a 60-bit integer which JS computes as ordered. However double only has 52 bits for the mantissa and so can't possibly contain the full value. So JS ...


0

Looking at the latter part of your question you're asking how to brute force the shared secret for a diffie-helman key exchange. The best known method for this is to solve discreet log. Trial multiplication seeks to brute force the answer to discreet log. I write below to answer this brute force as it seems to be what you are asking. If you're using normal ...


1

Can Eve break it if she can solve Diffie-Hellman problem? Yes, at least, the computational Diffie-Hellman problem. This problem is "given the triplet $h, h^x, h^y$, recover $h^{xy}$" Let us assume that Eve has an Oracle that solves this problem. Then, she sets $h=m^{ab}$, $h^x = m^b = (m^{ab})^{a^{-1}}$ and $h^y = m^a = (m^{ab})^{b^{-1}}$, and passes $h, ...


2

There is no need to decrypt here, so an encryption scheme is not the right fit. The parties simply need to compute a deterministic function whose outputs are random to your central machine --- i.e., a pseudorandom function. You should use a PRF like HMAC or GMAC etc. If you use a PRF, then what you have is essentially what is described in the following work ...


2

Yes, there is a more secure way to achieve your goal. For uniqueness you can use SIV mode with a static nonce. SIV mode first calculates a MAC over the plaintext and then uses that as IV to the mode of operation. This means that identical plaintext will result in identical ciphertext, but that plaintext that only differ by a single bit will result unrelated ...


2

Breaking the Generalized Diffie-Hellman (GDH) assumption is known to imply Factoring for Blum-integers. This is a result by Biham et al. Since the (non)-equivalence of the RSA and Factoring assumptions is one of the biggest open questions in the RSA literature, it would be really surprising if there was a reduction from GDH to the RSA assumption, because ...


2

In this paper you can find nearly everything about Curve25519. In the section "Specification" you find the answer: {Curve25519 secret keys} × {Curve25519 public keys} → {Curve25519 public keys} this is the function, which is calculated for a key exchange. So the shared secret key has the same properties as the public keys: { $q: q \in ${ $0,1,...,2^{...


1

Sure, first you set up a 1:1 communication and then you establish trust in it. This is kinda like TLS 1.3 where encryption starts as soon as possible. Of course, anything up to the authentication of the entity and handshake can be generated by an adversary, so it is slightly dangerous in that sense. And in general, you would try and authenticate as many ...


0

I think the point missing from the answers is that the certificates containing the public keys are validated up through the CA that signed the public key certificate (if you trust the signing CA). If you just get a public key or public key certificate from someone and don't check it (either out of band with the person you think you are communicating to, or ...


1

This is "covered" by section 4.1 of the X3DH spec: Before or after an X3DH key agreement, the parties may compare their identity public keys $IK_A$ and $IK_B$ through some authenticated channel. For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document. Signal ...


12

Can you please give me some direction for such proof? You're looking for a proof that the RSA problem is hard? No such proof is known (even in the specific case of $e=3$). Furthermore, there is no known reduction to a 'more fundamental' problem, such as factorization or discrete log. The closest we can get is a proof that if you can find the 'decryption ...


Top 50 recent answers are included