# Tag Info

6

The basic baby-step-giant-step algorithm can be tweaked to make use of this information. The following algorithm takes $\Theta(\!\sqrt{k-j})$ group operations. Let $h:=c\cdot g^{-j-1}$, which equals $g^{i-j-1}$. Pick some integer $m\geq\sqrt{k-j-1}$. Initialize an empty lookup table $T$. For all $0\leq a<m$, compute $g^{ma}$ and store $T[g^{ma}]:=a$. For ...

2

The problem lies in the trust of the public key. If an attacker can simply replace one of the exchanged public keys with his own then an active MITM attack is possible. The attacker simply replaces both public keys with his own and proceeds to create two channels that rely on the shared secrets. For ephemeral key pairs - as commonly used - the key pairs are ...

0

I think what you are looking for is impossible. To see this, let's formalize things a bit: You have an oracle (the HW token) $T(Q)=[x]Q$ which computes a scalar product of any given input point with a secret scalar. You have an integer (or a byte sequence) $t$ - the tweak - and you have a public point $Q'$ from your partner as well as of course a standard ...

0

This is broken, because possession of Epriv (a function of the public tweak value) allows calculation of the output of tokenECDH(Epub) given knowledge of tokenPub (another public value). This is stupid obvious now, but it took several days to figure it out.

3

How is this done efficiently on the fly for Diffie Hellman? For Finite-Field Diffie-Hellman, you usually pick $p$ such that $q=(p-1)/2$ is also prime. Now Lagrange's theorem tells us that every element's order must divide the group order which is $p-1=2q$. This leaves us with four divisors: $1,2,q,2q$. Once you know that, you can simply test that your ...

0

Consider a device A and a device B. Let me paraphrase what I believed you just said. Communication happens only from A to B. We have public keys $PK_A$, $PK_B$, and the private keys $PrK_A$, $PrK_B$. Devices A and B apply the Diffie-Hellman key exchange protocol to obtain a shared secret, $SS$. You say that it is logical to use $SS$ as a key for AES ...

0

this is convenient because each new key is used one-time and depends on the root key and message, so you do not need to constantly announce the next new key and wait for confirmation, because if Bob reads the encrypted message, he knows the encryption key and can decrypt the next message, this reminds blockchain by the way, since by exchanging messages that ...

0

It's very common for mathematicians to have a hard time understanding the concept that isomorphic groups can have drastically unequal difficulty of discrete logarithms. For example, consider the additive group $(\mathbb{Z}/n\mathbb{Z}, +)$. Repeated addition here is just multiplication, so the discrete logarithm problem becomes: \text{Given } (x, \alpha x)...

2

The answer depends on the attack your are interested in. For passive attackers who are eavesdropping on the exchanging of information, the attacker has to solve an instance of the Diffie-Hellman problem which is believed to be difficult. For active attackers who can tamper with the information exchanging, "textbook" Diffie-Hellman is not safe. To prevent ...

0

I'm editing a previous response I wrote here. Apologies if you read the other. I missed that you gave the context of a instant messaging protocol. Your process description is very different from how TLS implements forward secrecy. At this point I'd just say that in your scenario, it is not necessary that each message use a new symmetric key. It's ok to ...

3

You can do ECDH with more than two parties. See the below adaptation of the wikipedia example for an EC group - The parties agree on the algorithm parameters, a curve over $E(\mathbb{F}_p)$ and base point $G$. The parties generate their private keys, named $a$, $b$, and $c$ (these are integers). Alice computes $aG$ and sends it to Bob. Bob computes \$(aG)b = ...

0

Note the first paragraph of the page: In public-key cryptography, the Station-to-Station (STS) protocol is a cryptographic key agreement scheme. The protocol is based on classic Diffie–Hellman, and provides mutual key and entity authentication. Unlike the classic Diffie–Hellman, which is not secure against a man-in-the-middle attack, this protocol assumes ...

5

Currently we do not think that 512 bit DH is secure. You can look for more secure parameters (i.e. above 1280 bits at the very least) is secure. Secure key sizes can be found at keylength.com. For DH you can e.g. look at the NIST recommendations for "Discrete Logarithm" (the underlying mathematical problem that is the base of DH-based cryptography). Using ...

Top 50 recent answers are included