Skip to main content
140 votes
Accepted

In end-to-end encryption, doesn't the server need to be trusted?

End-to-end encryption over a channel with an eavesdropper, like the WhatsApp server, works by using a mathemagical spell called Diffie–Hellman key agreement. What follows is not actually how WhatsApp ...
Squeamish Ossifrage's user avatar
67 votes

How can I make sure non-open source programs are really using end-to-end encryption?

Is there's a way to make sure that non-open source programs are really using end-to-end encryption? Only by deep reverse-engineering. Which is hard, and might be illegal. Plus the apps are a moving ...
fgrieu's user avatar
  • 142k
40 votes
Accepted

What makes Quantum Cryptography secure?

TL;DR     The answer is classical cryptography. Besides a quantum link, secure data communication with Quantum Cryptography (more precisely, Quantum Key Distribution) uses classical links, ...
fgrieu's user avatar
  • 142k
35 votes

Why is this not a viable key exchange algorithm?

I've simplified the Alice random bytes to ARB and Bob random bytes to BRB. Then the protocol follows as; Alice knows $key$ and $ARB$ and sends $$C_1 = key \oplus ARB$$ Bob knows $C_1$ and $BRB$ and ...
kelalaka's user avatar
  • 49k
34 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
Squeamish Ossifrage's user avatar
22 votes
Accepted

Is it possible to establish a shared secret over an untrusted unidirectional channel?

Let me reformulate your initial question. Bob wants to send a message to Alice such that Eve cannot know the content of the message. Bob has no prior knowledge about Alice. This is impossible. Proof: ...
Gilles 'SO- stop being evil''s user avatar
17 votes
Accepted

Relation between Key-exchange and Public-Key encryption schemes

First, some definitions. A public key encryption scheme (PKE) is a scheme with public and private keys, where we can encrypt a message using the public key and decrypt using the private key. A key ...
K.G.'s user avatar
  • 4,770
15 votes
Accepted

How to generate the exact AES key in both client and server side?

There are two main ways to have the same symmetric key on both parties: key exchange using asymmetric crypto generate the key from a known secret (eg: a password), such as using a password-based key-...
Marc's user avatar
  • 1,583
14 votes
Accepted

Does perfect forward secrecy (using DH or ECDH) imply quantum resistance?

No it does not. Perfect forward secrecy implies that even if you retrieve the private key of the asymmetric key pair that you cannot read any of the past or future messages within a connection. It is ...
Maarten Bodewes's user avatar
  • 93.2k
14 votes
Accepted

WhatsApp end-to-end encryption

If by "using them on a second device such as a PC running Windows" you mean that you open Whatsapp web there, then no you cannot decrypt your messages there. Whatsapp web is a client that connects to ...
Josef's user avatar
  • 362
14 votes
Accepted

What is the difference between a sealed box and a normal box in libsodium?

The premise of boxes is that Alice and Bob know each other and write to each other. Alice can use a box to send a message to Bob. On receipt of the box, Bob knows (a) it came from Alice, and (b) ...
Squeamish Ossifrage's user avatar
14 votes
Accepted

What are the differences between ephemeral-static ECDH and static-static ECDH?

Static static Diffie-Hellman isn't that commonplace. It uses two static key pairs (where both the public and private keys are static, not just the public key) to establish the secret. Generally those ...
Maarten Bodewes's user avatar
  • 93.2k
14 votes
Accepted

Is this variant of Diffie-Hellman viable and quantum resilient?

Is this actually a viable method of key exchange? No. An eavesdropper can find the integer $b$ chosen by Bob from $x$ (as sent by Alice) and $b'$ (as sent by Bob), and the equation $b'\,=\,b\,x\bmod ...
fgrieu's user avatar
  • 142k
11 votes
Accepted

Security requirements for EC Diffie Hellman implementation

Here's the obvious advice (other than "don't roll your own protocol/solution; reuse one that has already been vetted"): Make sure that you use a secure curve. Obvious alternatives are P256 (with ...
poncho's user avatar
  • 148k
11 votes
Accepted

Number of LWE samples in NewHope

They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
Joost's user avatar
  • 226
10 votes

How does one verify a GPG/PGP key revocation?

How does one verify a key revocation? As Jon Callas already stated: you simply don’t. In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/...
e-sushi's user avatar
  • 17.9k
10 votes

Why is Diffie-Hellman used instead of just RSA in key-exchange (TLS, IKE)?

What does DH add? Perfect Forward Secrecy. That is, suppose you have a secure session with the server Bob, and then you close the session down. Then, someone steals the server (or serves a warrant ...
poncho's user avatar
  • 148k
10 votes

What makes Quantum Cryptography secure?

@fgrieu already wrote a little book, so I'll restrict my answer to a minimum to avoid repetitions. Think of this as an extended comment (which indeed wouldn't have fit the comment size limits). What ...
e-sushi's user avatar
  • 17.9k
10 votes
Accepted

Do standalone Oblivious Transfer (OT) Protocols exist?

The term "stand alone" in secure computation typically refers to the case of a protocol being run once, and not to assumptions. In any case, what I assume you are really asking is what assumptions are ...
Yehuda Lindell's user avatar
9 votes
Accepted

Is there any SRP-like key exchange only using "standard" cryptographic primitives?

The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
Geoffroy Couteau's user avatar
9 votes

How to encrypt with elliptic curve cryptography (ECC)?

Why can't you encrypt a message with a public key generated via ECC? Well, for starters, you need to realize that ECC is a collective term for a number of protocols that use elliptic curves to do ...
poncho's user avatar
  • 148k
8 votes
Accepted

How does DH work when combined with ECC or RSA?

What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man ...
Maarten Bodewes's user avatar
  • 93.2k
8 votes
Accepted

Random Bytes in TLS Handshake

Since these bytes are sent in clear text, what is the relevance of them being random? They are a guarantee that the other party with whom you wish to communicate is actually interactively there and ...
SEJPM's user avatar
  • 46.1k
8 votes
Accepted

XOR instead of Multiplication in ElGamal encryption

One small question, from the DDH assumption we know $g^{xy}$ is random. Actually, that's not true. What the DDH assumption says is that we cannot distinguish $g^{xy}$ from $g^z$; however it does not ...
poncho's user avatar
  • 148k
8 votes

X3DH protocol - What are One-time prekeys for?

The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for. Suppose Alice sends a message to Bob. If Alice and Bob both erase the message, what is ...
Squeamish Ossifrage's user avatar
8 votes

In end-to-end encryption, doesn't the server need to be trusted?

There are different types of encryption. Symmetric encryption This is where one key is used for encrypting and decrypting, often called a shared secret. This is what many of us are familiar with ...
Pete's user avatar
  • 180
8 votes

Diffie-Hellman key space: 128 bit primes

"The DH key space for 128 bit is limited by how many primes existed in the finite field of Zp, where p is the largest prime that can be represented by a 128-bit value", so I got a bit confused about ...
poncho's user avatar
  • 148k
8 votes
Accepted

How does Dragonfly key exchange work, in non-white-paper terms?

Dragonfly is resistant to dictionary attacks, meaning that rather than an attacker being able to identify the use of a password in their dictionary with passive computation, they are forced to ...
poncho's user avatar
  • 148k
8 votes
Accepted

Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've recommended DH group 20-24 (we don't have DH group 24). Should we use these groups? NO, stick ...
SEJPM's user avatar
  • 46.1k
8 votes

For Diffie-Hellman, why is a g value of p−1 not a suitable choice?

If $g=p-1$ then $g\equiv -1\pmod p$ that is $g$ is effectively the same as $-1$ which has the obvious drawback that $g^x$ can only ever be $+1$ or $p-1$ which is easily brute-forcable. Here's a short ...
SEJPM's user avatar
  • 46.1k

Only top scored, non community-wiki answers of a minimum length are eligible