Diffie-Hellman: Difference between revisions
imported>Sandy Harris (add wikilink) |
imported>Sandy Harris No edit summary |
||
| Line 1: | Line 1: | ||
The '''Diffie-Hellman key agreement protocol''' (also just Diffie-Hellman or DH) allows two parties without any initial shared secret to create one in a manner immune to eavesdropping. Once they have done this, they can communicate privately by using that shared secret as a [[cryptographic key]] for a [[block cipher]] or a [[stream cipher]], or as the basis for a further key exchange. | The '''Diffie-Hellman key agreement protocol''' (also just Diffie-Hellman or DH) allows two parties without any initial shared secret to create one in a manner immune to eavesdropping. Once they have done this, they can communicate privately by using that shared secret as a [[cryptographic key]] for a [[block cipher]] or a [[stream cipher]], or as the basis for a further key exchange. | ||
The protocol is secure against all passive attacks, but it is not at all resistant to active [[man-in-the-middle attack]]s. If a third party can impersonate Bob to Alice and vice versa, then no useful secret can be created. Authentication of the participants is a prerequisite for safe Diffie-Hellman key exchange. There are several ways to do the required authentication. For example, in [[Internet Key Exchange]] (IKE, defined in RFC 2409), authentication can be done with a shared secret or with any of several [[public key]] techniques. | The protocol is secure against all passive attacks, but it is not at all resistant to active [[man-in-the-middle attack]]s. If a third party can impersonate Bob to Alice and vice versa, then no useful secret can be created. Authentication of the participants is a prerequisite for safe Diffie-Hellman key exchange. There are several ways to do the required authentication. For example, in [[Internet Key Exchange]] (IKE, defined in RFC 2409), authentication can be done with a shared secret or with any of several [[public key]] techniques. In [[Transport Layer Security]] (TLS, defined in RFC 2246), it is done by exchange of [[X.509]] Certificates. | ||
The Diffie-Hellman method is based on the [[discrete logarithm]] problem and is secure unless someone finds an efficient solution to that problem. It can use any of several variants of discrete log; common variants are over a field modulo a prime or a field defined by an elliptic curve. | The Diffie-Hellman method is based on the [[discrete logarithm]] problem and is secure unless someone finds an efficient solution to that problem. It can use any of several variants of discrete log; common variants are over a field modulo a prime or a field defined by an elliptic curve. | ||
Revision as of 02:27, 12 October 2008
The Diffie-Hellman key agreement protocol (also just Diffie-Hellman or DH) allows two parties without any initial shared secret to create one in a manner immune to eavesdropping. Once they have done this, they can communicate privately by using that shared secret as a cryptographic key for a block cipher or a stream cipher, or as the basis for a further key exchange.
The protocol is secure against all passive attacks, but it is not at all resistant to active man-in-the-middle attacks. If a third party can impersonate Bob to Alice and vice versa, then no useful secret can be created. Authentication of the participants is a prerequisite for safe Diffie-Hellman key exchange. There are several ways to do the required authentication. For example, in Internet Key Exchange (IKE, defined in RFC 2409), authentication can be done with a shared secret or with any of several public key techniques. In Transport Layer Security (TLS, defined in RFC 2246), it is done by exchange of X.509 Certificates.
The Diffie-Hellman method is based on the discrete logarithm problem and is secure unless someone finds an efficient solution to that problem. It can use any of several variants of discrete log; common variants are over a field modulo a prime or a field defined by an elliptic curve.
Given a prime p and generator g (see discrete logarithm), Alice:
* generates a random number a * calculates A = g^a modulo p * sends A to Bob
Meanwhile Bob:
* generates a random number b * calculates B = g^b modulo p * sends B to Alice
Now Alice and Bob can both calculate the shared secret s = g^(ab). Alice knows a and B, so she calculates s = B^a. Bob knows A and b so he calculates s = A^b.
An eavesdropper will know p and g since these are made public, and can intercept A and B but, short of solving the discrete log problem, these do not let him or her discover the secret s.