New answers tagged

0 votes

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I don't know if by the word "deniability" you mean something else, but I don't think the Double Ratchet protocol or any of its building blocks provide any kind of deniability security ...
  • 796
1 vote

Proof of Pohlig-Hellman Algorithm on Elliptic Curve

This is the case of the chinese remainder theorem (CRT) for the relatively prime moduli $m_i=p_i^{e_i}.$ They have decomposed the group order $p-1$ into $p-1=m=m_1 m_2 \cdots m_k.$ There are many ...
  • 17.7k
3 votes
Accepted

Trying to understand the 2nd subgroup in the Weil Pairing used for the MOV attack

Firstly, I think that some terminology may be causing some problems. The Frobenius automorphism in a field of characteristic $p$ is the map $x\mapsto x^p$ and respects all of the field operations and ...
  • 14.8k
1 vote

Small subgroup confinement attack on Diffie-Hellman: shared key is 1

Diffie Hellman is vulnerable to an active man in the middle (MITM) attack, and this is one version of such an attack, since Eve is modifying the transmitted values and forwarding them on. See for ...
  • 17.7k
2 votes
Accepted

The Uniqueness of Baby-step-Giant-step Algorithm on DLP

It's unique modulo the multiplicative order of $a$ modulo $N$. Suppose that there were two solutions: $$a^{n_1}\equiv ba^{-m_1k}\mod N;\quad\quad a^{n_1}\equiv ba^{-m_2k}\mod N$$ this would tells us ...
  • 14.8k
2 votes

"Cropping" the resulting shared secret from ECDH

You should hash your secret. (In fact, you should not just hash it, but process it with a key derivation function such as HKDF that has been specifically designed for this purpose.) Doing so ...
0 votes

Distributing the Master Public Key in Identity-based Encryption systems

The master public key is public, so it can be distributed like any other message. The key generator can send it to all devices using a one-to-one protocol like CoAP or a pub/sub protocol like MQTT. ...
10 votes
Accepted

"Cropping" the resulting shared secret from ECDH

You should apply the hash. If one follows the specification there are only roughly $2^{251}$ possible shared secret values and there is a simple test to see if a putative 32 bytes represents a ...
  • 14.8k
0 votes
Accepted

Mapping DH / DHE p & g params to a group

In these cases the system is determined by the prime $p$ (you can check that the values 0xabc31... and 0x a4d37... are prime if ...
  • 14.8k

Top 50 recent answers are included