New answers tagged key-exchange
2
Aren't they delievering by the network the same as the encypted messages?
No. At least not in the plain.
What doing it end-to-end encrypted?
Try to search for the key agreement protocol (e. g. Diffie-Hellman ) and asymmetric encryption (e.g. RSA ).
The "asymmetric" encryption allows sending encrypted and signed messages without sharing the private (...
3
TL;DR: The public key is not a point, it is the $x$-coordinate of the point.
The base point of the curve has been chosen to be the point $G = (9,y_0)$ with $y_0>0$, and the curve Curve25519 is used in its Montgomery form given by the equation
$$
y^2 = x^3 + 486662x^2 + x.
$$
The main operation on elliptic curves is the scalar multiplication, and in this ...
1
In general, asymmetric cryptography (which includes elliptic curve crypto, RSA, Diffie-Hellman, etc) is orders of magnitude slower than symmetric cryptography (e.g., AES). Curve 25519 is fast compared to other asymmetric cryptography, but still very slow compared to symmetric encryption.
Because of this, asymmetric cryptography is mostly used to set up ...
1
A number of reasons contribute to this.
Curve25519 has a non-governmental origin.
It's a curve that's very safe by design, and impregnable to many side-channel and other weaknesses that other curves suffer from.
Also, it's a curve with 'nothing up my sleeve' coefficients.
Unlike the NSA curves, which NIST endorse.
Although not directly related, after ...
0
One possible reason for avoiding non-safe primes in the context of DH key exchange is to avoid small subgroup attacks like those identified in the paper by Valenta et al. (NDSS 2016).
1
So, why do the NIST/TLS standards not allow for cofactors greater than 2?
Actually, NIST does allow larger cofactors - see table 1 in SP800-56A - they allow the subgroup (q) to be significantly smaller than the modulus (p).
As for TLS, previous versions of TLS (1.2 and earlier) did allow the server to specify the group (and made no requirements about the ...
1
Cycles (not necessarily Hamiltonian) in the Cayley graph correspond to relations among generators of the group. The RSA assumption can be written as "It is computationally difficult to find a non-trivial relation in the RSA group $(\mathbb{Z}/pq\mathbb{Z})^*$", which is a property of $(\mathbb{Z}/pq\mathbb{Z})^*$ known as being "pseudo-free" (see The RSA ...
1
TL;DR: $a$ and $b$.
For DHE in the multiplicative group modulo $p$, it is agreed on a large prime $p$ and an element $g$. This is typically long term, and there are standard public parameters, e.g. the 3072-bit MODP group of RFC 3526
After this, each time two parties A and B want a shared secret
party A draws a random $a$ and sends $h_A = g^a\bmod p$ ...
0
The Otway-Rees protocol has been widely used as an example in the study of the formal analysis of authentication protocols, but has not been used in practice. Such implementations as exist have been in the form of input to protocol analysis tools or academic exercises.
One example is a thesis Implementation of Otway-Rees Protocol. Note that this does not ...
1
M connects the two enciphered parts of the second message so that $S$ can detect a message constructed from parts of previous messages by an intruder. Other protocols of the time used double encipherment to do the equivalent. Double encipherment required either two enciphering engines or a path for arbitrary data that bypasses the enciphering engine. This ...
Top 50 recent answers are included
