364

Diffie-Hellman is a way of generating a shared secret between two people in such a way that the secret can't be seen by observing the communication. That's an important distinction: You're not sharing information during the key exchange, you're creating a key together. This is particularly useful because you can use this technique to create an encryption ...


303

I dug out my copy of Applied Cryptography to answer this concerning symmetric crypto, 256 is plenty and probably will be for a long long time. Schneier explains; Longer key lengths are better, but only up to a point. AES will have 128-bit, 192-bit, and 256-bit key lengths. This is far longer than needed for the foreseeable future. In fact, we cannot even ...


141

The other answers do an excellent job explaining the maths behind the key exchange. If you'd like a more pictorial representation, nothing beats the excellent paint analogy shown on the Diffie–Hellman key exchange Wikipedia entry: Image is in the public domain


103

Public Keys are designed for sharing, read access to and or publishing a public key is fine Private Keys are secret, they should only be accessible to the owner of said private key. To drive this point home, think back to every HTTPS website you have ever visited. In each case, as part of HTTPS the site gives you their public key. So not only is it safe ...


77

The reason why RSA keys are so small is that: With every doubling of the RSA key length, decryption is 6-7 times times slower. So this is just another of the security-convenience tradeoffs. Here's a graph: Source: http://www.javamex.com/tutorials/cryptography/rsa_key_length.shtml


61

None, that's why it is called a public key. It can not be used to access anything encrypted for you without solving math problems that are currently prohibitively difficult to solve. It is possible that in the future it may be possible to solve these problems and that would cause the public key to allow messages to be decoded, but there is no current known ...


60

Is it completely safe to publish an ssh public key? No, but you can do it anyway without worries (lots of people do, just look at https://sks-keyservers.net/i/ or https://pgp.mit.edu/) The reason why it's not completely safe is because if I know your public key, I can, with a neat piece of mathematics, calculate your private key. Your public key contains a ...


56

If the attacker is able to passively capture data and later gets access to the private key of the certificates (i.e. stealing, heartbleed attack or law enforcement), then the attacker could decode all previously captured data if the encryption key is only derived from the certificate itself. DH key exchange makes it possible to create a key independent from ...


48

It's like one of these: Say you want to secure something in a box. Anyone can close the lock (public key). This means anyone will be able to put something into the box and lock the box (they won't be able to open the lock once it's locked (you just pinch these closed)). The key to open the lock is something only you have (private key). You are the only one ...


37

Diffie-Hellman is an algorithm used to establish a shared secret between two parties. It is primarily used as a method of exchanging cryptography keys for use in symmetric encryption algorithms like AES. The algorithm in itself is very simple. Let's assume that Alice wants to establish a shared secret with Bob. Alice and Bob agree on a prime number, p, and ...


33

Nothing is "completely safe"; the question is whether it adds any additional risks. The SSH protocol sends the client's public key encrypted, only after it has negotiated a symmetric session encryption key with the server. So an adversary that eavesdrops on the connection doesn't learn the client's public key. This means that publishing it does give the ...


31

If you want a simpler plain English explanation of DH that can be readily understood by even non-technical people, there is the double locked box analogy. Alice puts a secret in a box and locks it with a padlock that she has the only key to open. She then ships the box to Bob. Bob receives the box, puts a second padlock that only he has the key to on it, ...


30

The operation at the core of RSA is a modular exponentiation: given input m, compute me modulo n. Although in general this is a one-way permutation of integers modulo n, it does not fulfill all the characteristics needed for generic asymmetric encryption: If e is small and m is small, then me could be smaller than n, at which point the modular ...


29

This preference of symmetric cryptography over asymmetric cryptography is based on the idea that asymmetric cryptography uses parametrized mathematical objects and there is a suspicion that such parameters could be specially chosen to make the system weak. For instance, when using Diffie-Hellman, DSA or ElGamal, you have to work modulo a big prime p. A ...


26

No, unless you use a unique one per service. It lets attackers identify you. If you use the same public key for service A and service B, and your public key gets leaked for both of them, this will cross-link your two accounts together. Hopefully neither of the two services is embarrassing. But even in that case, this will give the attacker a better lead ...


25

X.509 is a format for certificates: a certificate is a sequence of bytes which contains, in a specific format, a name and a public key, over which a digital signature is computed and embedded in the certificate. The signer is a Certification Authority which asserts that the public key is indeed owned by the entity known under that name. By verifying the ...


25

The key used in HMAC is, by definition, symmetric: the same key is used to compute the MAC value, and to verify the MAC value. Digital signature algorithms are asymmetric, which means that the key for verification is distinct from the key used for generation; this "difference" is strong: the key used for generation cannot be recomputed from the key used for ...


24

The key exchange problem A secure connection requires the exchange of keys. But the keys themselves would need to be transfered on a secure connection. There are two possible solution: exchange the key by physically meeting and sharing the keys. Somehow established a shared secret on a public unsecure channel. This is easier said than done, and the first ...


21

You can't. This is a fundamental principle of general purpose computing. You're running into Shannon's maxim: The enemy knows the system. One ought design systems under the assumption that the enemy will immediately gain full familiarity with them. Just to make my point completely clear: you're giving someone a car, and asking them to only ever drive to ...


20

You cannot have a secure signature scheme in less than 50 bits. Demonstration: the attacker can just enumerate all sequences of 50 bits until a match is found. Indeed, one point of digital signatures is that the verification algorithm can be computed by just everybody, since it uses only the public key (which, by definition, is public). Best you can hope, ...


19

Just to expand on a couple bits of info alluded to above, there are basically two risks to consider, neither of them relating to the algorithms (those are safe). First, is incidental data leakage. Do you run slaterockandgravel.com as Mr. Slate but have your key signed fflintstone@slaterockandgravel.com? Did Betty sign your key and you don't want the world ...


17

If it is public it cannot be secret... A key is "a parameter for an algorithm, which concentrates secrecy". This means that the key is not only secret, but, normally, nothing else is (algorithms are known to everybody). A public key is a paradoxic terminology which was coined when asymmetric cryptography was invented. The "real" key is what we call the ...


17

There are many steps needed to understand the reasons and I will try to guide you through each. 1) Use encryption correctly... With RSA algorithm, Alice and Bob can just share their public keys (public_a, public_b) and keep their private keys (private_a, private_b). Alice can just send Bob the messages which are encrypted by private_a, and Bob can ...


15

I cannot reconcile in my head how or why the roles of the keys suddenly reverses. (I'm primarily focusing on RSA signatures.) Anyone can produce an encrypted message (by using your public key) and only you can decrypt it (by using your private key). The roles of public and private key reverse because a signature has to be something that only you can ...


14

In addition to the great answer by @Lucas, you can make the comparison: Symmetric cryptography is like a door lock. Everyone that has a key can lock and unlock: Asymmetric cryptography is like a common lock or handcuff. Anyone can lock it but only the (private) key unlocks it:


13

I found these videos easy to understand and usefull: https://www.youtube.com/watch?v=3QnD2c4Xovk The second is starting with SSL, but later the guy is speaking about symmetric and asymmetric cryptography: https://www.youtube.com/watch?v=JCvPnwpWVUQ


13

This depends on the algorithm. Especially with asymmetric cryptography, the speeds vary wildly. You may want to check out eBACS for more detailed and machine-independent benchmarking of various crypto primitives. As always, you need to perform your own benchmark on your own system to know exactly what to expect on a production system under the chosen ...


12

As far as RSA goes, this provides a good example that can be followed and shows corresponding examples of input and output. This demo application will walk you through the various steps and allow you check the work. Sometimes just clicking your way through something in steps like that will help. For Wikipedia articles, you need to look at the actual ...


12

"Proving" depends on whether the recipient (Bob) cooperates (i.e. accepts to reveal his private key to the verifier), and also on the type of cryptographic algorithms and details of the key. If Bob cooperates, then he may decrypt the message; this may show that the message "makes sense" when decrypted with Bob's private key, which is a rather strong hint ...


Only top voted, non community-wiki answers of a minimum length are eligible