New answers tagged

0

One possible explanation would be that the "shared secret" is in fact derived from all or part of this quadruplet sent out-of-band : (database IP, database name, account user name, account password). The password is meant to be secret after all. But given that many databases transition to using Native Network Encryption, and that there is no ...


2

The paper The Relationship between Breaking the Diffie-Hellman Protocol and Computing Discrete Logarithms contains some results of interest, although they are somewhat technical. Specifically, it needs: Smoothness Assumption: For $n\in\mathbb{N}$, define $\nu(n)$ to be the minimum, over $d\in [n-2\sqrt{n}+1, n+2\sqrt{n}+1]$ of the largest prime factor of $d$...


0

In fact $DH1, DH2$ and $DH3$ are not "announced through untrusted channels". I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself. To be more concrete, if IK_A = g^{sk_A}, and SPK_B=g^{sk_B}, with $sk_A$ a secrete value already known by Alice. Then she could compute DH(...


2

Another pro is that the curve is designed to help protecting against side-channel attacks. More precisely, there is a birational equivalence to the Edwards curve $x^2 + y^2 = 1 + dx^2y^2$ with $d = 121665/121666$ as an element in $\mathbb{F}_p$ with $p=2^{255}-19$. Since $d$ is not a square in $\mathbb{F}_p$, the addition law on this curve is 'complete': ...


2

with pre-shared knowledge DH key exchange seems not neccessary? Here, the phrase pre-shared knowledge may refer to a shared password I'll restrict to this and thus assume a pre-shared secret, rather than dive into the more complex question of pre-shared public keys. The reasons to still use DHKE when there is a pre-shared secret are that, with proper ...


0

The generation of session key is to power public key with private key where private key is an integer $< 2^{160}-1$, which is 160 bit. Therefore, it takes 159 squares and 0.5*160 multiple(in average).


0

Yes, it would work, but it has some serious flaws: First, DH is often used when there's no opportunity to pre-share a key, such as when a user first visits a web site, or when an attacker might have stolen a pre-shared key. Second, if you've got a pre-shared key you could just use that as the input key material to a Key Derivation Function in a Symmetric-...


2

Big picture is: the hash is used to turn the "combined key" of the question into symmetric keys used in a protocol. That's useful because the "combined key" is not a uniformly random bitstring, and because multiple keys with no exploitable dependence are needed. Quoting RFC4253: The "diffie-hellman-group1-sha1" method ...


2

Attacks: Of course one can attack the Curve with Brute Force, but that's not very effective. But there are generic discrete logarithms attacks for elliptic curves in general. They can be applied to Curve25519. Examples are Pollard-Rho-attack, Shanks’-Baby-Step-Giant-Step-attack, Pollard-Kangaroo-attack. Here you can find more attacks. Pros: The main ...


2

RSA allows for signatures. Signatures are a system whereby someone with a private key can "sign" a message, and anyone with the corresponding public key can verify that that private key was used to sign the message. (Elliptic-Curve) Diffie-Hellman (aka ECDH or DH) allows for exchanging a shared secret value, which is then passed through a Key ...


2

Kudos for the question's critical thinking. Keep on with that attitude! Eve wants to find $\log_g(g^x)$ which gives her $x$. Why is it a problem? She knows $g$ and she knows what the number $g^x$ is. The problem as stated in this quote and with $g$ in the set $\mathbb Z$ (the integers) is the logarithm problem restricted to integers, and indeed is easy. ...


1

you are only looking at base 10 and e. There are some other in practice, base 2 for binary. Base 16 for Hex, Base64 etc. | what is DLP ? Fix a prime p , Let ${\beta}$ and ${\alpha}$ be non-zero integers mod p and suppose $${\beta \equiv \alpha ^x (mod p)}$$ The problem of finding x is called Discrete Logarithm Problem. if n is the smallest positive integer ...


0

That much risk is acceptable in Signal protocol as it only affects small number of messages of the sending chain. As soon as Alice replies, the ratchet starts new sending chain and the keys in compromised chain can be no longer used to compromise new messages. Ratchet has the nice property of being “self healing.” If, for whatever reason, any individual ...


Top 50 recent answers are included