New answers tagged key-exchange
2
As X3DH uses elliptic curve Diffie-Hellman, I'll write things in elliptic curve notation thus if we have a curve $E$ with $q$ points and a base point $G$ we might see Alice choose a private key $a\pmod q$ and create a public key $A=aG$. It should be easy to convert to multiplicative notation if you need to.
Regular Diffie-Hellman
In the regular form of the ...
1
I like it, but it only shows the use of 1 secret key, there's no concept of public key.
The exchanged "mixed colors" are the public keys in the scheme.
Also, color may not be as intuitive as I like because people tend to think you can unmix (even if we made the hypothesis we can't.) And a real-world experiment would probably get messy.
Sorry, ...
3
You're right that it's not UC-secure, for exactly the reason you say. It allows offline dictionary attacks. Here's how that problem manifests in the UC model:
Consider this particular environment:
Environment chooses honest party's password $pw$ uniformly from some known polynomial-size dictionary $\mathcal D$ (without loss of generality $\mathcal{D} = \{1,...
2
Although it is not forward secure against client-side compromise (i.e. disclosure of the user agent's long term private key), it is forward secure against server-side compromise (i.e. disclosure of all information available to the server).
Thus, for example, if ownership of the application server is transferred from one company to another and the user's ...
3
If $p$ and $q$ are powers of two, as in Saber, then multiplying and diving by $p$ and $q$ amounts to simple bit shift operations.
In Saber, $p = 2^{10}$ and $q = 2^{13}$. Thus, $p/q = 1/2^3$ and $x/8$ can be computed by a right-shift of 3 bits. Using the $bits$ notation, $\frac{p}{q}x = bits(x, \log(p/q), \log p)$.
But we can do better, and also compute the ...
0
I think wPFS is absurd.
They describe wPFS attack scenario as below in their paper.
[Beyond eCK: Perfect Forward Secrecy under
Actor Compromise and Ephemeral-Key Reveal?
Version 2.0, 19 October 2017] page 4
The adversary, impersonating party $\hat A$, generates a random value x and sends $g^x$ to a responder session at party $\hat B$. $\hat B$ responds by ...
Top 50 recent answers are included
