33

TL;DR     The answer is classical cryptography. Besides a quantum link, secure data communication with Quantum Cryptography uses classical links, a lot of mathematically provable classical cryptography, and a setup procedure using initially trusted material just as in classical cryptography. To perform the same other than by the One Time Pad, ...


10

Handing keys, in general, is known as key management. Symmetric keys should be kept secret from other parties than the participants in the scheme. The term "secret key" is often used as a synonym for the symmetric key. The private keys for asymmetric schemes are not shared, but are of course also kept secret, as privacy implies secrecy. The establishment ...


9

Here's what can happen if you don't do this verification: Suppose Alice, Bob and company generate their public key shares honestly, $h_2, h_3, ..., h_n$ Now, Snidely Whiplash (who is also a trustee) is the last to contribute his share, he selects a private key $x_{evil}$ and computes $h_{evil} = g^{x_{evil}}$. However, instead of sharing $h_{evil}$ as his ...


8

@fgrieu already wrote a little book, so I'll restrict my answer to a minimum to avoid repetitions. Think of this as an extended comment (which indeed wouldn't have fit the comment size limits). What makes Quantum Cryptography secure? … what makes it more secure than the classical version? In classical crypto, things like three party key distribution ...


6

This depends largely on the trustworthiness of Facebook and your assumptions about the model and attacker. If Facebook is corrupted, they will just exchange your information to their address/public key and can still do a man-in-the-middle. An external attacker could modify the profile pages while they are being transmitted to other users or in their browser,...


5

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...


5

My turn! In classical cryptography between two peers over a channel such as the internet, an eavesdropper on the channel learns a transcript of information from which secrets could theoretically be derived. For example, the eavesdropper learns Diffie–Hellman public keys $g^a$ and $g^b$, which with unbounded computation could be used to recover the peer's ...


5

For an OTP to provide perfect secrecy it is required that the key stream is indeed purely random. A pure OTP is largely a theoretical construct because it is almost impossible to generate a key stream that is provably random. Any kind of information on the key stream may leak information on the plaintext, which means it is not perfectly secure. Practical OTP'...


5

Key Distribution. Key distribution is, well, the process of distributing (cryptographic) keys to different parties. Usually this involves mechanisms which are considered "out-of-band", i.e. mechanisms that don't use the later communication channel for the transport of keys. Alternatively key distribution can be done by relying the distribution of new keys ...


5

The answer is both yes and no, as I explain below. 1. No, BBM92 is better (or at least, we initially thought so) E91 was the initial idea which led to the more rigorous BBM92. In the E91 paper, there is not actual security proof, ant the attack is not really specified: if the CHSH inequality is violated by only a few percents (say $S=2.05$), how many ...


4

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess this ...


4

Ed25519 is a typical elliptic-curve signature scheme, in a group of large prime order $\ell \approx 2^{252}$ on a curve over the field $\mathbb F_p$ for $p = 2^{255} - 19$. A secret key is a uniform random 32-byte string; a signature is a 64-byte string encoding a point $R$ on the curve generated by the standard base point, and encoding a scalar $s \in \...


3

OpenPGP supports an approximation to what you seek, albeit with at best weak privacy guarantees: To transmit the message $m$, Alice picks a session key $k$ and sends $$E_{f_1}(k) \mathbin\| E_{f_2}(k) \mathbin\| \cdots E_{f_n}(k) \mathbin\| \operatorname{AES-CFB'}_k(m),$$ more or less. Here $\operatorname{AES-CFB'}$ is OpenPGP's bespoke variant of CFB mode. ...


3

I think the difference between key exchange and key distribution can be very subtle, but it probably comes down to the former being an active way of "dealing" keys, while the latter is something that can be more passive. I think a few examples may make this more clear. Key exchange Alice and Bob want to communicate over a private channel. They both know ...


3

The key must be kept secret or it is no longer an encryption system. They key must be shared at some point, when is not important, but how is, and how determines when. You can send encrypted messages to someone, then hand them the key on a post-it note at a later point in time so they can decode it, or on a flash drive, or some other physical handoff or ...


3

For the purposes of a bloom filter you need a number of hash functions. Cryptographic hash functions are designed so that changing a single bit in the input should change many (around 1/2) of the output bits. So, say you have a good hash function $h$ (e.g., SHA256 though MD5 should work for your purposes too) a good option for you would be to use use: $h_1(...


3

An easier way of explaining it is here: http://www.demoivre.org/courses/CIS628/chapter15.pdf So for a point $(x_0,y_0,z_0)$ we set $x_0$ as the secret and then randomly choose $y_0$ and $z_0\pmod{P}$. Now we generate our plane to distribute to the participants: we pick two random integers $a$ and $b$, then we set $$C = z_0 - ax_0 -by_0 \pmod{P}$$ we now ...


3

The sender receives the public key through some other (secure) channel. The whole security of public key encryption relies on precisely this "small detail": there must be a way for the sender to obtain the receiver's public key through some other, secure channel. The definition of "channel" is actually very broad here, and denotes simply a means of ...


3

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something? So the idea of PFS is that if the entire (secret) state of an entity at a time point $x$ is leaked and there ...


3

This principle is commonplace, it is a key derivation from a shared secret. The academic thing to do is to use a Key Derivation Function or a MAC where hash of a concatenation is used, perhaps $$\operatorname{HMAC-Hash}\;[\;\text{Key}=\text{(EC)DH Shared Secret},\,\text{Message}=\text{Counter}\;]$$ We call the output a derived key, and it can be a one-use ...


2

Yes, the Pseudo Random Number Generator (PRNG) in OpenSSL is Cryptographically Secure, which means it passes statistical tests, but as @Maarten Bodewes suggests in his comment, why not go one step further and use that PRNG directly, rather than through OpenSSL? OpenSSL can use EGD (which stands for Entropy Gathering Daemon). It is a process that taps into ...


2

Kab is session key, which generated by KDC and must be new every time. So the most simple answer is: Bob could not to decrypt {Kab,A}Kab, because he does not know Kab before step 3.


2

If there is no known information about the other side and there is no trusted third party (or any kind of chain of trust), then there is no encrypted comunication possible. Cryptography always has to build upone something, it doesn't work without assumptions: You can't verify the other persons identity, you can't verify any claims, and you can't know if ...


2

1) How Alice and Bob agree on which of the two beam splitters bases (Horizontal-Vertical and Right-Left) correspond to which of the classical bits (1 and 0) ? How do Alice and Bob agree on when actual transmission starts, when it is time to send/receive a photon taking note of event ? Alice and Bob operate according to an agreed-upon protocol, which can ...


2

Look into the Signal protocol and its associated Double Ratchet algorithm. This changes DH keys after every message without much overhead. As no prime generation is involved in generating new DH keys, there is no expensive processing that would make this impractical. If you don't want to change as often as once per message, you can perform the ratchet once ...


2

We call this idea a key derivation function (hashing the ECDH secret) for a stream cipher (expanding a short secret and a counter into a long pad). This idea is not problematic or weak; in fact, it is ubiquitous. For example, a part of the TLS protocol essentially works as follows: Agree on an ECDH secret $s$. Derive a session key $k = H(s)$ by hashing $s$...


2

I believe the end goal is to use the QKD data as a one-time pad, so the QKD rate would need to be the same as the plaintext data rate. That is the only guaranteed-secure method. (Although I think QKD might be a bit of a scam.) Also, you can't use a key forever. I recently made a 400Gbps AES-GCM encryptor. You're not supposed to send more than 2^32 ...


Only top voted, non community-wiki answers of a minimum length are eligible