Diffie-Hellman is a method for establishing a shared secret that can be used as a cryptographic key.

learn more… | top users | synonyms

113
votes
6answers
77k views

“Diffie-Hellman Key Exchange” in plain English

Can someone explain to me what Diffie-Hellman Key Exchange is in plain English? I have read in a non-tech news page that Twitter has just implemented this technology which allows two persons to ...
74
votes
4answers
31k views

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?
72
votes
5answers
8k views

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
66
votes
3answers
50k views

Is there any particular reason to use Diffie-Hellman over RSA for key exchange?

I often see RSA being recommended as a method of key exchange. However, the Diffie-Hellman key exchange method appears to be secure as well. Is there any considerations one should take into account ...
43
votes
4answers
5k views

Why is key exchange necessary at all?

Let's say "Alice" and "Bob" want to communicate with each other over an insecure network. Using Diffie–Hellman key exchange, they can get the same symmetric key at last. However, as I understand, ...
26
votes
2answers
3k views

What is the current security status of Diffie-Hellman key exchange?

There is a web site weakdh.org, whose name alone would certainly cause some feeling of uncertainty in using DH among people who are not experts IMHO. Could some knowledgeable person kindly say ...
23
votes
3answers
18k views

Can someone explain what exactly is accomplished by generation of DH parameters?

I'm setting up a node.js server: https.createServer({ ... ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', honorCipherOrder: true }, app).listen(443); ...
22
votes
2answers
6k views

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
20
votes
2answers
23k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
19
votes
3answers
16k views

How to check if a server is not vulnerable to Logjam?

In response to Logjam I want to prove I've hardened my services. I know that the DH param has to be 2048 bits at least and self generated. But I am unable to find a way to actually check this for ...
13
votes
1answer
7k views

Diffie Hellman parameters still calculating after 24 hours

I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./...
13
votes
1answer
2k views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
13
votes
2answers
22k views

Diffie-Hellman and its TLS/SSL usage

I'm struggling to understand the (non-)use of Diffie-Hellman (DH) in TLS. DH has been around for a long time now, why does almost nobody use it, yet? DH is only being used for "key sharing", why ...
13
votes
6answers
4k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
13
votes
1answer
3k views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
12
votes
1answer
7k views

What are the OpenSSL standard Diffie Hellmann parameters (primes)?

I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process. I used the following ...
11
votes
2answers
12k views

OpenVPN dhparam

One of the steps for setting up OpenVPN is running the command openssl dhparam -out dh1024.pem 1024. The man page tells me this 1024 value refers to the number of bits. Why is the value 1024 ...
11
votes
1answer
228 views

Diffie-Hellman large prime number weakness. Is this concept valid? If so, how can this be remediated by end-users/admins?

So I saw this blog post on “How is NSA breaking so much crypto?”. The basic idea of this blog post is this: There is an inherent weakness in Diffie-Hellman that stems from services using the same ...
10
votes
2answers
11k views

What is the difference between Diffie Hellman generator 2 and 5?

Generating Diffie Hellman parameters in OpenSSL can be done as follows: $ openssl dhparam -out dh2048.pem 2048 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a ...
10
votes
3answers
579 views

Is ECDH for SEC P-384 and P-521 broken in Windows 10 / Windows Server 2016 TP3?

UPDATE: Proof of concept code here, console output shown below and all involved certificates are here. Just noticed that ECDiffieHellmanCng.DeriveKeyMaterial(...) behaves differently on Windows 8.1 ...
9
votes
3answers
2k views

Is 8192 Diffie-Hellman overkill?

I've finally ran SSL server test on my server and was presented with: This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B. So I tried to generate stronger ...
9
votes
1answer
5k views

How does SSH use both RSA and Diffie-Hellman?

SSH protocol 2 allows you to use DSA, ECDSA, ED25519 and RSA keys when establishing a secure connection to a server. (Keep in mind for this question that I'm only familiar with the procedure and ...
9
votes
2answers
9k views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption (...
8
votes
2answers
9k views

1024-bit DHE vs 2048-bit RSA

Currently with apache/mod_ssl, if DHE is enabled then a 1024-bit ephemeral key will be used. I found the following quote in Adam Langley's blog: Ideally the DH group would match or exceed the RSA ...
8
votes
2answers
4k views

DH parameters recommended size?

I'm setting up EAP-TLS on my wireless router, and am currently generating DH parameters for FreeRADIUS. First, what do these parameters do? Also, what size should they be? I've been generating the ...
7
votes
2answers
6k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
7
votes
1answer
153 views

Do Diffie-Hellman parameters need to be recreated regularly?

Having generated 2048-bit DH params, do I need to regenerate them regularly? If so, how frequently should I do this?
7
votes
2answers
3k views

Are Telegram secret chats secure assuming MTProto isn't?

For those who don't know: Telegram is a partially open source Whatsapp alternative (Server is closed source) which offers secret chats and normal chats. Secret chats are encrypted with Diffie-Hellman ...
7
votes
2answers
6k views

What is the difference between DHE and ECDH?

I learned that perfect forward secrecy is implemented through DHE and ECDH but what is the difference between these 2 key exchanges? Also can someone explain how perfect forward secrecy works? I've ...
6
votes
4answers
4k views

What is the role of RSA in ECDHE-RSA? [duplicate]

I have read some textbooks and not found a convincing explanation. In the cipher suite ECDHE-RSA-AES128-GCM-SHA256, what is the role of RSA in the first part (ECDHE-RSA)? This part of the cipher ...
6
votes
2answers
233 views

Should I test my SSL certificate for “RSA Shared Primes” before using it?

There are several papers from 2012 that say it's possible to factor several moduli by factoring shared primes. The link above includes python sourcecode to verify and test for this fact. Given this ...
6
votes
0answers
50 views

Share diffie hellman group between servers

I'm deploying several servers with TLS. The servers are different but related and each having their own certificate generated by letsencrypt. And to up the security I'm generating my own diffie ...
5
votes
2answers
80 views

Where in a TLS connection can I get the signature of the content sent by the server?

I want to be able to prove that a given content returned by a HTTPS server was in fact served. I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's ...
5
votes
2answers
9k views

Is there a key length definition for DH or DHE?

I found this in wiki The Finite Field Diffie-Hellman algorithm has roughly the same key strength as RSA for the same key sizes. The work factor for breaking Diffie-Hellman is based on the discrete ...
5
votes
1answer
331 views

ECDH BouncyCastle KeyAgreement length

I am attempting to obtain a shared secret using BouncyCastle's ECDH methods in C#, however I am receiving a shared key which is much shorter than the 48 bytes I expect it to be. I have a trusted ...
5
votes
2answers
2k views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
5
votes
2answers
138 views

What DH Group size do TLS Ephemeral DHE ciphers use?

In SSL/TLS, the Client and the Server have the option to use an Ephemeral Diffie-Hellman exchange to establish a shared secret for which to seed the ensuing Master Secret and Session keys. In the ...
5
votes
2answers
458 views

OpenSSL vulnerability CVE-2015-0205

I can't seem to make any sense out of the following vulnerability in OpenSSL: DH client certificates accepted without verification [Server] (CVE-2015-0205) ============================================...
5
votes
1answer
75 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
5
votes
1answer
87 views

What are 'screened' DH groups?

Currently it's recommended to do something about the contents of /etc/ssh/moduli. I've seen two ways: to strip all moduli of less than 2047 bytes size from the file. to recreate them using ssh-...
5
votes
2answers
115 views

Should diffie-hellman parameters be unique to a vhost

So I'm setting up one host to serve multiple SSL sites. I've been following various guides like https://cipherli.st/ and https://wiki.mozilla.org/Security/Server_Side_TLS and they both suggest to ...
4
votes
10answers
3k views

Why not use symmetric encryption?

Something very simple: most of us communicate most of the time with people we already know. Alice and Bob probably have physical contact, too. Yes, there are cases when whistle-blowers want to contact ...
4
votes
3answers
3k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...
4
votes
1answer
5k views

In OpenVPN, is the dh1024.pem file dependent on the CA?

As the question already states, I'd like to know if the dh1024.pem file, generated by ./build-dh in openvpn, is dependent on the ca.(crt|key) file. The reason was that I needed to ./clear-all the ...
4
votes
2answers
2k views

What are the implications of using the same DH parameters in a TLS server?

For a DHE cipher, nginx hard-codes the Diffie-Hellman parameters to use base 2 and a fixed 1024-bit prime (modulus) if no custom DH parameters are configured. These parameters are public (sent in ...
4
votes
1answer
1k views

Diffie-Hellman key exchange

The following image attempts to explain the diffie-hellman key exchange for people not strong in maths such as myself: I do understand how the colour/paint example illustrates the idea. But I'm a ...
4
votes
2answers
123 views

Does changing /etc/ssh/moduli impact previously generated keys?

My company does a lot of automated file transfers over SSH/sftp with banks, etc. A recent SSH upgrade on a server dropped support for the old/weak diffie-helman-group1-sha1 key exchange protocol in ...
4
votes
5answers
537 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
3
votes
2answers
2k views

Why should the dh keylength match rsa length in tls?

A few sources state that the DH keylength (bits of the prime) should match the keylength of rsa for TLS. For example SSL_set_tmp_dh(3) from openssl has example code on how to match the dh parameters ...
3
votes
3answers
130 views

How can DH provide a known secret to two parties over an unencrypted connection without it being intercepted via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...