Diffie-Hellman: Difference between revisions
imported>Howard C. Berkowitz No edit summary |
imported>Sandy Harris No edit summary |
||
| Line 8: | Line 8: | ||
| editor = C. Kaufman, | | editor = C. Kaufman, | ||
| date = December 2005 | | date = December 2005 | ||
| url = http://www.ietf.org/rfc/rfc4306.txt}} authentication can be done with a shared secret or with any of several [[public key]] techniques.<ref name=RFC4282>{{citation | | url = http://www.ietf.org/rfc/rfc4306.txt}}</ref> authentication can be done with a shared secret or with any of several [[public key]] techniques.<ref name=RFC4282>{{citation | ||
| id = RFC5282 | | id = RFC5282 | ||
| title = Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol. | | title = Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol. | ||
| Line 40: | Line 40: | ||
The protocol can be subverted if either Alice or Bob uses a weak [[random number]] generator. The attacker can then make guesses at a or b; a correct guess breaks the system. If the random number generator is weak, the number of guesses required for this attack may not be prohibitive. However, with large p and a good [[pseudorandom number generator]], it is wildly impractical. | The protocol can be subverted if either Alice or Bob uses a weak [[random number]] generator. The attacker can then make guesses at a or b; a correct guess breaks the system. If the random number generator is weak, the number of guesses required for this attack may not be prohibitive. However, with large p and a good [[pseudorandom number generator]], it is wildly impractical. | ||
==References== | ==References== | ||
{{reflist|2}} | {{reflist|2}} | ||
Revision as of 02:08, 16 October 2008
Template:TOC-right The Diffie-Hellman key agreement protocol (also just Diffie-Hellman or DH) allows two parties without any initial shared secret to create one in a manner immune to eavesdropping. Once they have done this, they can communicate privately by using that shared secret as a cryptographic key for a block cipher or a stream cipher, or as the basis for a further key exchange.
The protocol is secure against all passive attacks, but it is not at all resistant to active man-in-the-middle attacks. If a third party can impersonate Bob to Alice and vice versa, then no useful secret can be created. Authentication of the participants is a prerequisite for safe Diffie-Hellman key exchange. There are several ways to do the required authentication. For example, in Internet Key Exchange (IKE),[1] authentication can be done with a shared secret or with any of several public key techniques.[2] In Transport Layer Security (TLS),[3]it is done by exchange of X.509 Certificates.
The Diffie-Hellman method is based on the discrete logarithm problem and is secure unless someone finds an efficient solution to that problem. It can use any of several variants of discrete log; common variants are over a field modulo a prime or a field defined by an elliptic curve.
Given a prime p and generator g (see discrete logarithm), Alice:
* generates a random number a * calculates A = g^a modulo p * sends A to Bob
Meanwhile Bob:
* generates a random number b * calculates B = g^b modulo p * sends B to Alice
Now Alice and Bob can both calculate the shared secret s = g^(ab). Alice knows a and B, so she calculates s = B^a. Bob knows A and b so he calculates s = A^b.
An eavesdropper will know p and g since these are made public, and can intercept A and B but, short of solving the discrete log problem, these do not let him or her discover the secret s.
The protocol can be subverted if either Alice or Bob uses a weak random number generator. The attacker can then make guesses at a or b; a correct guess breaks the system. If the random number generator is weak, the number of guesses required for this attack may not be prohibitive. However, with large p and a good pseudorandom number generator, it is wildly impractical.
References
- ↑ C. Kaufman,, ed. (December 2005), Internet Key Exchange (IKEv2) Protocol, RFC4306
- ↑ D. Black, D. McGrew (August 2008), [www.ietf.org/rfc/rfc5282.txt Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol.], RFC5282 }}
- ↑ T. Dierks, E. Rescorla (August 2008), The Transport Layer Security (TLS) Protocol Version 1.2., RFC5246