139 votes
Accepted

In end-to-end encryption, doesn't the server need to be trusted?

End-to-end encryption over a channel with an eavesdropper, like the WhatsApp server, works by using a mathemagical spell called Diffie–Hellman key agreement. What follows is not actually how WhatsApp ...
user avatar
66 votes

How can I make sure non-open source programs are really using end-to-end encryption?

Is there's a way to make sure that non-open source programs are really using end-to-end encryption? Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving ...
user avatar
  • 124k
39 votes
Accepted

What makes Quantum Cryptography secure?

TL;DR     The answer is classical cryptography. Besides a quantum link, secure data communication with Quantum Cryptography (more precisely, Quantum Key Distribution) uses classical links, ...
user avatar
  • 124k
35 votes

Why is this not a viable key exchange algorithm?

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and ...
user avatar
  • 43.4k
34 votes
Accepted

Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

Simplified SSLv3/TLS from this book Note, $R_{(Alice|Bob)}$ is a random nonce chosen by Alice or Bob respectively, and $\{S\}_{Bob}$ is encryption with Bob's public key. pre-master secret As stated ...
user avatar
  • 37.7k
22 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
user avatar
16 votes
Accepted

What Diffie-Hellman parameters should I use?

I recommend avoiding Diffie-Hellman parameter generation. Instead, use a standardized DH group with a sufficiently large modulus (2048-bit or larger). For example, group #14 or #15 from RFC3526 (see ...
user avatar
  • 2,704
15 votes

Status of Algebraic Eraser key exchange?

The first part of this partial self-answer uses additional information I received from Professor Simon R. Blackburn, one of the author of the recent attack. The method used to generate parameters is ...
user avatar
  • 124k
15 votes
Accepted

How to generate the exact AES key in both client and server side?

There are two main ways to have the same symmetric key on both parties: key exchange using asymmetric crypto generate the key from a known secret (eg: a password), such as using a password-based key-...
user avatar
  • 1,573
14 votes
Accepted

WhatsApp end-to-end encryption

If by "using them on a second device such as a PC running Windows" you mean that you open Whatsapp web there, then no you cannot decrypt your messages there. Whatsapp web is a client that connects to ...
user avatar
  • 362
14 votes
Accepted

Is this variant of Diffie-Hellman viable and quantum resilient?

Is this actually a viable method of key exchange? No. An eavesdropper can find the integer $b$ chosen by Bob from $x$ (as sent by Alice) and $b'$ (as sent by Bob), and the equation $b'\,=\,b\,x\bmod ...
user avatar
  • 124k
13 votes

Key exchange using ECDH vs ECIES?

That's a bit of a strange question. ECDH is a key agreement protool. ECC does not have a direct form of encryption as RSA has. ECIES is basically ECDH used to derive a symmetric key, which is then ...
user avatar
  • 85.2k
13 votes
Accepted

ECDH or RSA more secure for symmetric key wrapping?

Yes, there are a few reasons to prefer ECDH over RSA: ECDH will perform much better; ECDH can provide forward security when used with ephemeral key pairs without a large performance overhead for ...
user avatar
  • 85.2k
13 votes

What are the differences between ephemeral-static ECDH and static-static ECDH?

Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those ...
user avatar
  • 85.2k
12 votes
Accepted

Relation between Key-exchange and Public-Key encryption schemes

First, some definitions. A public key encryption scheme (PKE) is a scheme with public and private keys, where we can encrypt a message using the public key and decrypt using the private key. A key ...
user avatar
  • 4,402
12 votes
Accepted

What is the difference between a sealed box and a normal box in libsodium?

The premise of boxes is that Alice and Bob know each other and write to each other. Alice can use a box to send a message to Bob. On receipt of the box, Bob knows (a) it came from Alice, and (b) ...
user avatar
11 votes
Accepted

Security requirements for EC Diffie Hellman implementation

Here's the obvious advice (other than "don't roll your own protocol/solution; reuse one that has already been vetted"): Make sure that you use a secure curve. Obvious alternatives are P256 (with ...
user avatar
  • 132k
11 votes
Accepted

Number of LWE samples in NewHope

They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
user avatar
  • 226
10 votes

Why is hybrid encryption more effective than other encryption scheme?

Alice also needs to first decrypt the symmetric key and then decrypt the message. It almost seems like a double work. Encrypting a short plaintext (i.e. the symmetric key) requires only one ...
user avatar
  • 2,704
10 votes

What asymmetric key exchange algorithms are known besides DH?

Using lattices/ring-LWE, there is Lattice Cryptography for the Internet (by me), which inherits from Ring-LWE encryption, and has been implemented by Bos et al. with further improvements by Alkim et ...
user avatar
10 votes

Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?

What does DH add? Perfect Forward Secrecy. That is, suppose you have a secure session with the server Bob, and then you close the session down. Then, someone steals the server (or serves a warrant ...
user avatar
  • 132k
10 votes
Accepted

Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

No it does not. Perfect forward secrecy implies that even if you retrieve the private key of the asymmetric key pair that you cannot read any of the past or future messages within a connection. It is ...
user avatar
  • 85.2k
10 votes

What makes Quantum Cryptography secure?

@fgrieu already wrote a little book, so I'll restrict my answer to a minimum to avoid repetitions. Think of this as an extended comment (which indeed wouldn't have fit the comment size limits). What ...
user avatar
  • 17.4k
9 votes

Quantum key distribution simulation

There are several kinds of quantum key distribution (QKD) protocols as of today. Are you looking for a particular one? The best-known QKD protocol goes by the name BB84 after its inventors Bennett and ...
user avatar
  • 455
9 votes

Exchanging encrypted messages, and decrypting without a public key?

You're describing a form of three-pass protocol, which is a communication mechanism where neither party needs to know each other's secret key. Wikipedia describes a helpful metaphor using a box that ...
user avatar
  • 190
9 votes
Accepted

Is there any SRP-like key exchange only using "standard" cryptographic primitives?

The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
user avatar
8 votes

How does one verify a GPG/PGP key revocation?

How does one verify a key revocation? As Jon Callas already stated: you simply don’t. In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/...
user avatar
  • 17.4k
8 votes

Quantum key exchange skepticism/confusion

Let’s take your questions in order. Note that I’m a physicist working in quantum cryptography, so my opinion on this might be biased 1. What about authentication ? The classical channel between Alice ...
user avatar
8 votes

Differences between the terms "pre-master secret", "master secret", "private key", and "shared secret"?

When a TLS/SSL session starts (after the hellos and cipher decisions) the server gives the client its cert. The key in the cert could perform different actions depending on the key agreement algorithm ...
user avatar
  • 551
8 votes
Accepted

How does DH work when combined with ECC or RSA?

What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man ...
user avatar
  • 85.2k

Only top scored, non community-wiki answers of a minimum length are eligible