We’re rewarding the question askers & reputations are being recalculated! Read more.

# Tag Info

Here's the problem with this scheme: suppose $A$ is the honest client, and $B$ is a dishonest server (who doesn't know $s$). Then, $A$ tries to log in, he selects $a$ and transmits $$A = g^{as} \bmod p$$ Then, $B$ just picks a random value $b$, and transmits $$B = g^b \bmod p$$ Then, $A$ will compute a 'shared secret' $$S = B^a \bmod p$$ (which would be ...
(in DH) Bob used a small secret key that can be brute-forced. If the private key is $k$-bit, a meet in the middle attack allows private key recovery with cost $O(2^{k/2})$ group operations (here, multiplication in the modulo $p$ group $\Bbb Z_p^*$). In its simplest form: we know Bob's public key $y=g^x\bmod p$ and want the $k$-bit $x$. We choose $a$ with $\... 0 The sender must know and trust something about the intended receiver. Otherwise, the sender can't know who s/he shares a secret with. Also, the intended receiver must know and trust something about the intended sender; otherwise, the receiver will share a secret but can't know with who. The standard solution is that the above known and trusted "somethings" ... 0 It could have three consequences. 1) If you are very unlucky, and you pick a "zero" ($a$such that$a=0\mod p-1 \$), it will break your system : (but this will happen with a negligible probability, and it could be detected) An external observer will easily guess the shared secret 2) You lose in efficiency 3) Your integer had to be chosen upper-bounded (you ...