New answers tagged key-exchange
0
The defense is explained on page 22:
Sendrier’s “support splitting” algorithm quickly finds $\alpha_1, \cdots, \alpha_n$ given $g$ provided that $n = q$. More generally, whether or not $n = q$, support splitting finds $\alpha_1, \cdots, \alpha_n$ given $g$ and given the set $\{\alpha_1, \cdots, \alpha_n\}$. (This can be viewed as a reason to keep $n$ ...
1
If you are implementing this for commercial purpose, respectively if security is crucial, then there are standards and somewhat "best practices" (like the TLS Protocol Specs).
In general when you want two parties to agree on a shared secret key, some kind of Key-Exchange like Diffie-Hellman or ECDH is applied. Often this goes hand-in-hand with some ...
1
Why different keys are generated for initator and responder for encryption?
Well, some encryption algorithms (for example, GCM and ChaCha/Poly1305) are unsafe if multiple encryptors can use the same keys. This could be managed (in the above examples, by making sure that the two sides use different nonces, e.g. the initiator always uses even nonces and the ...
2
Are there any disadvantage of using it as in IKEv1?
Well, there were a couple of things; the most glaring one was determining why the negotiation failed.
What happened if two IKEv1 implementations tried to negotiate with different PSKs? What happened was that they derived different keys, and so it would fail - with no indication that the failure reason was ...
2
Very bad things happen. Let $E' := E/〈R_A〉$ be the image curve of the isogeny $φ:E→E'$ with kernel $R_A$:
$φ$ is not injective on $E[\ell_A^{e_A}]$: it maps it to a cyclic subgroup $G ⊂ E'[\ell_A^{e_A}]$;
The isogeny $\hat{φ}:E' → E'/G$ is the dual isogeny of $φ$;
In particular $E'/G$ is isomorphic to $E$.
Thus if both $R_A$ and $R_B$ were points in $E[\...
Top 50 recent answers are included
