39 votes

What is the current security status of Diffie-Hellman key exchange?

The weakdh.org Web site is about the Logjam attack. Contrary to what the Web site name may suggest to the unwary, this is not about DH being weak; it is more about doing things weakly when using DH. ...
Thomas Pornin's user avatar
22 votes
Accepted

What is the difference between DH and DHE?

Diffie-Hellman is an asymmetric algorithm, with a public key and a private key. In a "DH_RSA" cipher suite, the server's "permanent" key pair is a DH key pair. The public key is in the server's ...
Thomas Pornin's user avatar
20 votes
Accepted

When exactly is Diffie-Hellman used in TLS?

DH is a key exchange algorithm, it is used to derive the session key that's later used in the symmetric encryption. DH by itself is not authenticated, so while you can derive the session key without a ...
Lie Ryan's user avatar
  • 31.4k
19 votes
Accepted

RSA key exchange

TL;DR: Skip to "Using result of DH". Because you started with "I want to create a message exchange program" together with "I don’t know how to use DH", a tedious preface: ...
Z.T.'s user avatar
  • 8,494
14 votes
Accepted

Why is Mozilla recommending predefined DHE groups?

I think the reason for using predefined groups is clearly answered at the page your reference: Instead of using pre-configured DH groups, or generating their own with "openssl dhparam", ...
Steffen Ullrich's user avatar
13 votes

What is the current security status of Diffie-Hellman key exchange?

First of all, don't panic, Diffie-Hellman's algorithm is totally fine if used right (with right set of parameters). Let me explain some preliminaries: Whats SSL/TLS Protocol? It's the underlying ...
Silverfox's user avatar
  • 3,407
12 votes
Accepted

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

In general TLS 1.2 and below (TLS 1.3 has changed things, but your server doesn't support TLS 1.3 so it's not relavent) ciphersuites can be divided into two categories. Traditional and Ephemeral. In ...
Peter Green's user avatar
  • 5,300
11 votes

"Diffie-Hellman Key Exchange" in plain English

Securing data as it passes through the internet usually requires protecting it in two ways: Confidentiality -- assuring no one except the intended recipients can read the data Integrity -- assuring ...
Eddie's user avatar
  • 781
11 votes
Accepted

How to optimize the diffie hellman key exchange algorithm

DON'T ROLL YOUR OWN CRYPTO Writing a crypto implementation is hard: not only does it have to "work" in the sense that the math is right, you're properly handling big ints, etc; but it has to be "...
Mike Ounsworth's user avatar
11 votes

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

"dh key too small" is about the size of the key in the DH (Diffie Hellman) key exchange. This is unrelated to the size of the RSA key in the certificate. The key in the certificate is only ...
Steffen Ullrich's user avatar
9 votes
Accepted

Online Diffie-Hellman Tool

How DH parameters are generated There are two types of generators for DH parameters. Each generator has two steps: a step that requires random input, and a deterministic step. The two steps are the ...
forest's user avatar
  • 66.7k
9 votes
Accepted

Why does TLS 1.3 deprecate custom DHE groups?

With TLS 1.2 the server first needed to tell the client within the ServerKeyExchange message about the parameters of the DHE group it supports. Only then the client could act on these. With TLS 1.3 ...
Steffen Ullrich's user avatar
9 votes
Accepted

Why do you need random number for ECDH shared key computation

See the documentation for the mbedtls_ecdh_compute_shared() function here. Note where it reads: If f_rng is not NULL, it is used to implement countermeasures against side-channel attacks. For more ...
mti2935's user avatar
  • 23.4k
8 votes
Accepted

One Time Pad Algorithm without sharing keys

An eavesdropper will see all three messages (M xor A), (M xor A xor B) and (M xor B) He combines them with (M xor A) xor (M xor A xor B) xor (M xor B) which gives M
Jeff's user avatar
  • 3,609
8 votes

How can disabling Diffie-Hellman cipher for packet inspection be secure?

TL,DR: using this product strictly as recommended most likely violates your compliance rules. This is not because of the Diffie-Hellman aspect, but I still wouldn't use it, partly because the DH ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

ECDH and static key encryption

Your understanding is broadly correct, but in security and especially in cryptography, “broadly correct” often doesn't cut it. There is a standard for encryption using elliptic curve cryptography to ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

When does chrome generate the prime number for TLS communication?

Never. Chrome does not support FFDHE (which is how TLS calls Diffie–Hellman over the multiplicative group of integers modulo p) since 2016. Chrome only support ECDHE over NISP P-256, NISP P-384 and ...
Z.T.'s user avatar
  • 8,494
7 votes
Accepted

Diffie Hellman prime attributes

What is the prime represented in? Plain base 16 encoding of actual number. How can it be converted to an actual prime integer? Just convert from base 16. Like so: $ echo "ibase=16;...
StackzOfZtuff's user avatar
7 votes
Accepted

Diffie Hellman Group Matching to IPSec Encryption Algorithm

Update 21 Oct 2017. I found some useful info in RFC 5114 under Section 4 "Security Considerations". Based on this recommendation, we can consider DH Groups 14 and 24 as too weak to protect ...
Mister_Tom's user avatar
7 votes
Accepted

How does TLS work (RSA, Diffie-Hellman, PFS)?

Frankly I don't expect this to be terribly useful. Be that as it may .... As a preliminary matter almost everything you say is for TLS up to version 1.2 only. TLS version 1.3, which makes fairly major ...
dave_thompson_085's user avatar
7 votes
Accepted

Diffie-Hellman with non-prime modulus

TL;DR: Yes, it possibly could be decrypted. NOTE: I originally did not realize your question has a subtle nuance to it. You mention safe primes and then non-primes. But safe primes is a mathematical ...
Peter Harmann's user avatar
7 votes
Accepted

TLS 1.3 RSA key exchange

I've always thought that a server's TLS x509 certificate was passed to the client and certificate was used to encrypt traffic between client and server This approach isn't widely in use anymore since ...
user272480's user avatar
6 votes
Accepted

Why was running OpenSSL dhparam too fast?

When creating Diffie Hellman parameters it takes the most time to create the modulo p, which is a big prime number. To create this, a semi-random number is taken and checked for primality. If you are ...
Sjoerd's user avatar
  • 30.6k
6 votes
Accepted

Perfect forward secrecy using XOR

Anyone observing the exchange can just trivially calculate K! K = (K xor R1) xor (K xor R1 xor R2) xor (K xor R2) This are exactly the three messages which are sent in your protocol...
Josef's user avatar
  • 5,973
6 votes
Accepted

Why is the reuse of the Elliptic curve Diffie–Hellman (ECDH) public server param considered bad?

Note: I'm deliberately ignoring the difference between regular DH and elliptic curve DH. Doesn't matter here. Just poor phrasing. "public server param" vs. "Ephemeral DH parameters"...
StackzOfZtuff's user avatar
6 votes
Accepted

Is Diffie–Hellman key exchange protocol vulnerable to man in the middle attack?

It is vulnerable in one version. Just to be more clear, the three basic versions of Diffie-Hellman are: Anonymous DH, where Alice and Bob simply send each other unsigned values; Fixed DH (sometimes ...
A. Darwin's user avatar
  • 3,582
6 votes

Diffie-Hellman with non-prime modulus

Yes, it would be quite feasible to recover the shared secret, because you would now "only" have the discrete log problem modulo all the primes that make up the composite numbers. This could still take ...
AleksanderCH's user avatar
5 votes
Accepted

Is the OpenSSH server using a fallback, hard-coded DH parameter for 2048bits?

Fallback DH groups are defined in source code here. The current group can be 2k or 4k. But it really depends on which version are you using (there were some changes recently). Note the RFC 4419, ...
Jakuje's user avatar
  • 5,759
5 votes
Accepted

OpenSSL Generate ECDH Public Key

Try compressed version What you posted there as "example key that is working" is a base64 encoded EC pubkey without the PEM wrapper and without the usual line breaks. And more specifically it is a ...
StackzOfZtuff's user avatar
5 votes
Accepted

ECDH vs DH secret key size

AIUI (I am not a cryptographer) We measure the security of cryptography by asking "given the best known attack how much computing power would it take to break this". This is clearly an imperfect ...
Peter Green's user avatar
  • 5,300

Only top scored, non community-wiki answers of a minimum length are eligible