Let us assume the following: Alice and Bob are performing Diffie-Hellman key exchange over an unprotected channel. Eve is an active attacker (capable of dropping, modifying and constructing packets on the channel). Let's say that Alice and Bob can visually verify (by looking at an image generated from the hash or a letter-by-letter comparison of the base64 code), things that appear on their screens - I am strongly against visual verification of this kind because it is too easy for a naive user to accidentally provide a MiTM attack surface, however this is not the main question. The main question is which of the following is better:

  • Verify the hash of received DH-parameters (possible caveat: key sizes are much larger than hashes! And similar hashes are hard to tell apart visually)
  • Verify the hash of the exchanged key

An answer detailing advantages/disadvantages of both would be amazing (especially considering that the idea of visual verification of received parameters is quite tempting and maybe this question will help avoid the same problem Telegram has).


1 Answer 1


I assume from your question, there is another communication channel between Alice and Bob that can be used to verify the parameters (for example, Alice could call Bob and tell him the hash of g^A).

Theoretically, Eve could intercept g^A and compute its hash. Then Eve could try to perform a preimage attack (which can be virtually impossible, if proper hash algorithm has been chosen, but can be easy, if an improper algorithm has been chosen). Having g^E1 with the same hash as g^A and g^E2 with the same hash as g^B, Eve could facilitate MITM attack.

So it seems to me that verifying the hash of the secret g^(AB) is a better choice.

  • Hi! Sorry for the delay, thanks for the wonderful answer! What would probably make this answer perfect is a reference or perhaps a table of key sizes corresponding to hash sizes and the likelyhood (or computational power) required to find a collision, or something of the kind, I'm still accepting this though! Commented Feb 24, 2018 at 4:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .