# Tag Info

5

The answer to the linked question is pretty good; however I think I'll take another approach. In security, we need to assume that the attacker could possibly learn any secret; he might do this by attacking one of the human operators (possibly using either rubber hoses or large bags of cash), or stealing a hardware implementation and pulling it apart. ...

5

Contrary to Diffie-Hellman, this does not resist passive eavesdropping. An adversary capturing the network traffic will get the "freshly-generated keys" that "both peers send" in step 1, and can apply the algorithm of steps 2/3/4 to find the shared key that ultimately encrypts the traffic that follows.

2

It isn't; an attacker can encrypt any message. You have to add message integrity and authenticity to the plaintext or ciphertext. For this the sender needs to be able to authenticate the messages send. This obviously isn't possible using just the publicly available encryption key. When we're talking about separate messages (e.g. document protection) then ...

1

Is this scheme some well known scheme? It appears to be the well known $(n,n)$ secret sharing scheme, using a group operation (note: you said a finite field; however since you never use the multiplication operation, it works just as well over any finite group [1]). That is: $n-1$ of the secrets are random group elements $r_i$ The last group element is \$r_{...

1

No, it cannot. A nonce is necessary to have any security at all if a key is ever reused. The "nothing up my sleeve" number is necessary to keep the input from all being attacker controlled, it prevents the all-zero block, and its asymmetry improves the confusion and diffusion of the function.

Only top voted, non community-wiki answers of a minimum length are eligible