# Tag Info

4

First of all, generally, the shared secret is split in half because it consists of an X and Y coordinate. It is after all the point resulting in multiplying a public key point with a private key / vector, resulting in another point on the curve. Now the X and Y coordinate are related, so generally, only the X coordinate is used as a shared secret. Currently, ...

2

Am I right in thinking they should've piped the whole shared secret through the KDF to "compress" the 256 bits to 128 bits to retain 128-bit security? Using only 128 bits would not be the best practice, but does not open to attack as far as I know, for standard KDFs (which use all the entropy in their input). There's still effectively 128-bit ...

3

Yes, this is totally feasible. Unless $p$ is purposely chosen as a safe prime, there's a good chance that's easy. Computing $a$ given $B$, $p$, and $C=B^a\bmod p$ is a Discrete Logarithm Problem in the multiplicative group modulo prime¹ $p$, of order $r=p-1$. For any DLP problem, there is a generic attack of cost a few times $\sqrt r$ group operations, ...

0

Post-compromise security secures future messages if the key for present messages is compromised. It repairs itself by using key update process. Key update process derives new key for future messages by using assymetric key exchange like DHE and chain of key derivation function. If your present key is compromised by external sources, anytime when next DHE ...

3

To be DHKE group, there are five properties to be held, This is true; however, to be a secure DHKE group, there has to be an additional property: The "discrete log problem" needs to be hard; that is, given a public value $xG$ (where $G$ is the public group identifier, $x$ is your private value, and $xG$ is the generator acted upon itself $x$ ...

2

since the public key is calculated as Y=(alpha^private-key)mod(chosen prime) and alpha is a primitive root of prime, when Y becomes public then private key can be calculated easily right? One certainly hopes that it cannot be calculated easily, at least, for the 'chosen prime' that we pick. since there is a unique private key less than chosen prime that ...

0

It turns out this is possible and has been implemented in the libolm library of Matrix. The solution adopted in this library is to generate a signing key for each user. This is an Ed25519 keypair, which is used to calculate a signature on an object including both the public Ed25519 signing key and the public Curve25519 identity key. It is then the public ...

2

Your alternate method has an expensive public key operation for each push message. While the first protocol does a key exchange just once per subscription and then continues with a symmetric key. If in the key exchange both sides authenticated themselves (Or at least the Application) the user can rely on this, if authenticated encryption is used it still a ...

Top 50 recent answers are included