11
(1) I'm curious whether the following 10 different DH Groups are the only groups that TLS 1.3 supports,
Yes, in the sense that TLS 1.3 only allows groups that are explicitly declared as supported in 1.3. This currently includes not only the groups from RFC 8446, but possibly more recent RFC as well, such as Brainpool curves from RFC 8734.
The TLS supported ...
answered Jan 17 at 17:09
Gilles 'SO- stop being evil'
13.7k3 gold badges38 silver badges73 bronze badges
6
I couldn't figure out a field of order, say, 4, 8, 9 or 16. What are examples of such fields?
Let's do that with $8=2^3$.
Elements of that field $\mathbb F_{2^3}$ will be assimilated to $3$-bit quantities, that is the set $\{\mathtt0,\mathtt1\}^3$, or equivalently polynomials of degree less than $3$ with binary coefficients, where e.g. $\mathtt{110}$ is ...
6
The responsibility of the user of Curve25519 for DHKE is Section 3;
The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32
uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte.
This is a guarantee that the legitimate users ...
5
Yes, those are the 5 Elliptic Curves groups that are currently supported for ECDHE and 5 Finite fields for DHE.
If you want compliance with the TLS 1.3 standard, those are the only ones.
DHE is losing its ground to the ECC version since ECC is faster. If you insist to use DHE the use a field size larger than 2048.
one discussion into what curves should be ...
4
The question asks to prove the (true) fact that, in order to perform point addition $R\gets P+Q$ graphically on an Elliptic Curve over the field $\mathbb F_p$ of equation
$y^2\equiv x^3+a\,x+b\pmod p\tag{1}\label{fgr1}$
with $p$ suitably small (here $p=29$, $a=4$, $b=20$) and
$4\,a^3+27\,b^2\not\equiv0\pmod p\tag{2}\label{fgr2}$
we can (except in the special ...
3
Firstly, I am not sure about how I should narrow down the topic.
It is better to ask your advisor to help you for selecting a good research topic.
Secondly, which prerequisite knowledge do I need? Also, do you suggest any foundational books on the topic?
A roadmap for learning Elliptic Curve Cryptography:
Beginner: you can learn the basic of ECC by ...
3
On the Practical Exploitability of Dual EC in TLS Implementations by
Stephen Checkoway et al. (Usenix 2014) is some research that has been done on how much this NSA backdoor has affected the internet.
In short: It's hard to say. What saved a lot of systems from being compriomised is the fact that Dual_EC_DRBG was poorly executed and recommended against early....
3
The Group Law on Affine Coordinates
Arithmetical rules are derived from the line intersection and tangent equations. The formulas are;
Let $P=(x_1,x_2)$ and $Q=(x_2,y_2)$ be two point in the elliptic curve.
$P+O=O+P=P$
If $x_1 = x_2 $ and $y_1 = - y_2$ and $Q =(x_2,y_2)=(x_1,−y_1)=−P$ then $P + (-P) = O$
If $Q \neq -P$ then the addition $P+Q = (x_3,y_3)$ ...
3
You can see the list of all supported groups at the IANA, which tracks all of the assigned code points. There are many more items than are listed, although they aren't available in TLS 1.3.
In general, what you should use depends on (a) what security level you want to have, (b) what your software and hardware support, and (c) what your performance ...
2
The problem is that this requires relatively low level access to the cryptographic algorithms.
In general the private key can simply be set to a set of bits, although it should actually fit in the field. Setting the highest bit to zero is a dirty trick if the runtime(s) do not accept as many random bits as the key size. This will however let you use any kind ...
2
Yes, this is secure provided the message to be signed is unique on each login to prevent replay attacks. Usually that's done with either a random challenge or the signature over a shared secret.
In fact, SSH does this already with ECDSA keys: the two sides agree on a shared secret, which is hashed, and the client signs the hashed secret and some other data ...
2
However, I'm confused by what I should do with two different messages ($e_1 \ne e_2$) with the same $s_1$ and $s_2$
Well, if we consider how $s$ is computed:
$$s_i = m^{-1} ( \text{hash}(e_i) + r \cdot k )$$
If $s_1 = s_2$, then (because the private key $k$ is the same in both cases, and $m$ (the secret nonce) and $r$ are assumed to be the same, we have $\...
2
To obtain (62, 4) you just add points $\textbf{but on elliptic curves}$.
This is different from a "regular" addition, since the result must be a point of the curve (or a point said to be at infinity, I'm not explaining I try to keep things simple) .
Addition is defined and to do so either you use the heavy addition formulas (If you have seen groups ...
2
No, it is not possible to mix domain parameters / curves when performing key derivation.
First of all, the implementations are likely to fail if they find curve identifiers. These can be single protocol specific bytes, OID's or named curves or full parameter sets, depending on the protocol.
Second, it is very likely that implementations will reject the ...
2
This curve is thoroughly insecure. These researchers performed a computation to break discrete log on this exact curve.
All small characteristic pairing-friendly curves are insecure under modern knowledge. Here is another paper breaking discrete log on a curve over $\operatorname{GF}(3^{6\cdot 509})$ -- note that this field size is much bigger than your ...
1
Let see the details of the curve; Let $K = \operatorname{GF}(3^m)$ and the curve be defined by the equation $$E(K):y^2 = x^3 + 2x + 1 \quad\quad ;-1 \equiv 2 \bmod 3$$
Yes, it is supersingular
The group of rational points has order $$n = 19088056323407827075424725586944833310200239047$$
The order has two factors; $7 \cdot ...
Only top voted, non community-wiki answers of a minimum length are eligible
