140
votes
Accepted
In end-to-end encryption, doesn't the server need to be trusted?
End-to-end encryption over a channel with an eavesdropper, like the WhatsApp server, works by using a mathemagical spell called Diffie–Hellman key agreement. What follows is not actually how WhatsApp ...
- 47.9k
67
votes
How can I make sure non-open source programs are really using end-to-end encryption?
Is there's a way to make sure that non-open source programs are really using end-to-end encryption?
Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving ...
- 138k
40
votes
Accepted
What makes Quantum Cryptography secure?
TL;DR The answer is classical cryptography.
Besides a quantum link, secure data communication with Quantum Cryptography (more precisely, Quantum Key Distribution) uses classical links, ...
- 138k
35
votes
Why is this not a viable key exchange algorithm?
I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as;
Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$
Bob knows $C_1$ and $BRB$ and ...
- 47.5k
34
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
- 47.9k
17
votes
Accepted
What Diffie-Hellman parameters should I use?
I recommend avoiding Diffie-Hellman parameter generation. Instead, use a standardized DH group with a sufficiently large modulus (2048-bit or larger). For example, group #14 or #15 from RFC3526 (see ...
- 2,814
17
votes
Accepted
Relation between Key-exchange and Public-Key encryption schemes
First, some definitions.
A public key encryption scheme (PKE) is a scheme with public and private keys, where we can encrypt a message using the public key and decrypt using the private key.
A key ...
- 4,597
15
votes
Status of Algebraic Eraser key exchange?
The first part of this partial self-answer uses additional information I received from Professor Simon R. Blackburn, one of the author of the recent attack.
The method used to generate parameters is ...
- 138k
15
votes
Accepted
How to generate the exact AES key in both client and server side?
There are two main ways to have the same symmetric key on both parties:
key exchange using asymmetric crypto
generate the key from a known secret (eg: a password), such as using a password-based key-...
- 1,583
14
votes
Accepted
ECDH or RSA more secure for symmetric key wrapping?
Yes, there are a few reasons to prefer ECDH over RSA:
ECDH will perform much better;
ECDH can provide forward security when used with ephemeral key pairs without a large performance overhead for ...
- 91.7k
14
votes
Accepted
Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?
No it does not.
Perfect forward secrecy implies that even if you retrieve the private key of the asymmetric key pair that you cannot read any of the past or future messages within a connection. It is ...
- 91.7k
14
votes
Accepted
WhatsApp end-to-end encryption
If by "using them on a second device such as a PC running Windows" you mean that you open Whatsapp web there, then no you cannot decrypt your messages there.
Whatsapp web is a client that connects to ...
- 362
14
votes
Accepted
What is the difference between a sealed box and a normal box in libsodium?
The premise of boxes is that Alice and Bob know each other and write to each other. Alice can use a box to send a message to Bob. On receipt of the box, Bob knows (a) it came from Alice, and (b) ...
- 47.9k
14
votes
What are the differences between ephemeral-static ECDH and static-static ECDH?
Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those ...
- 91.7k
14
votes
Accepted
Is this variant of Diffie-Hellman viable and quantum resilient?
Is this actually a viable method of key exchange?
No. An eavesdropper can find the integer $b$ chosen by Bob from $x$ (as sent by Alice) and $b'$ (as sent by Bob), and the equation $b'\,=\,b\,x\bmod ...
- 138k
11
votes
Accepted
Security requirements for EC Diffie Hellman implementation
Here's the obvious advice (other than "don't roll your own protocol/solution; reuse one that has already been vetted"):
Make sure that you use a secure curve. Obvious alternatives are P256 (with ...
- 145k
11
votes
Accepted
Number of LWE samples in NewHope
They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
- 226
10
votes
How does one verify a GPG/PGP key revocation?
How does one verify a key revocation?
As Jon Callas already stated: you simply don’t.
In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/...
- 17.8k
10
votes
Why is hybrid encryption more effective than other encryption scheme?
Alice also needs to first decrypt the symmetric key and then decrypt the message. It almost seems like a double work.
Encrypting a short plaintext (i.e. the symmetric key) requires only one ...
- 2,814
10
votes
What asymmetric key exchange algorithms are known besides DH?
Using lattices/ring-LWE, there is Lattice Cryptography for the Internet (by me), which inherits from Ring-LWE encryption, and has been implemented by Bos et al. with further improvements by Alkim et ...
- 5,773
10
votes
Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?
What does DH add?
Perfect Forward Secrecy.
That is, suppose you have a secure session with the server Bob, and then you close the session down. Then, someone steals the server (or serves a warrant ...
- 145k
10
votes
What makes Quantum Cryptography secure?
@fgrieu already wrote a little book, so I'll restrict my answer to a minimum to avoid repetitions. Think of this as an extended comment (which indeed wouldn't have fit the comment size limits).
What ...
- 17.8k
10
votes
Accepted
Do standalone Oblivious Transfer (OT) Protocols exist?
The term "stand alone" in secure computation typically refers to the case of a protocol being run once, and not to assumptions. In any case, what I assume you are really asking is what assumptions are ...
- 27.6k
9
votes
Exchanging encrypted messages, and decrypting without a public key?
You're describing a form of three-pass protocol, which is a communication mechanism where neither party needs to know each other's secret key. Wikipedia describes a helpful metaphor using a box that ...
- 190
9
votes
Accepted
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
- 19.1k
9
votes
How to encrypt with elliptic curve cryptography (ECC)?
Why can't you encrypt a message with a public key generated via ECC?
Well, for starters, you need to realize that ECC is a collective term for a number of protocols that use elliptic curves to do ...
- 145k
8
votes
Accepted
How does DH work when combined with ECC or RSA?
What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man ...
- 91.7k
8
votes
Accepted
Random Bytes in TLS Handshake
Since these bytes are sent in clear text, what is the relevance of
them being random?
They are a guarantee that the other party with whom you wish to communicate is actually interactively there and ...
- 45.7k
8
votes
Accepted
XOR instead of Multiplication in ElGamal encryption
One small question, from the DDH assumption we know $g^{xy}$ is random.
Actually, that's not true. What the DDH assumption says is that we cannot distinguish $g^{xy}$ from $g^z$; however it does not ...
- 145k
8
votes
X3DH protocol - What are One-time prekeys for?
The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for.
Suppose Alice sends a message to Bob. If Alice and Bob both erase the message, what is ...
- 47.9k
Only top scored, non community-wiki answers of a minimum length are eligible