Lecture 7b: The Diffie-Hellman Secret Sharing Scheme Wayne Patterson SYCS 653 Fall 2009

The Diffie-Hellman Key Exchange Early in the development of the public key paradigm, a method to exchange secret or symmetric keys was devised by Whitfield Diffie and Martin Hellman, which is still in widespread use today.

The Diffie-Hellman Key Exchange As with the RSA, this involves the difficulty of factoring large integers, or, what turns out to be equivalent, solving the so-called “discrete logarithm” problem.

Diffie-Hellman Invented by Williamson (GCHQ) and, independently, by D and H (Stanford) (see Stamp, p. 70) A “key exchange” algorithm –Used to establish a shared symmetric key Not for encrypting or signing Security rests on difficulty of discrete log problem: given g, p, and g k mod p find k

The Diffie-Hellman Key Exchange First, a little more on prime numbers For every prime number p, and every number a mod p, we know by the Little Fermat Theorem that a p-1 = 1 (mod p). Any g for which all of the exponents a, a 2, …, a p-1 are distinct is called a primitive root of p, or a generator.

How to Find a Primitive Root Not easy, but not impossible. Mathematica has it built-in. Once you find one, easy to find many If g is a primitive root of p, then if GCD(m,p- 1) = 1 for m < (p-1), then g m is also a primitive root of p.

Diffie-Hellman Let p be prime, let g be a generator –For any x  {1,2,…,p-1} there is n s.t. x = g n mod p Alice selects secret value a Bob selects secret value b Alice sends g a mod p to Bob Bob sends g b mod p to Alice Both compute shared secret g ab mod p Shared secret can be used as symmetric key

Diffie-Hellman Suppose that Bob and Alice use g ab mod p as a symmetric key Trudy can see g a mod p and g b mod p Note g a g b mod p = g a+b mod p  g ab mod p If Trudy can find a or b, system is broken If Trudy can solve discrete log problem, then she can find a or b

Diffie-Hellman Public: g and p Secret: Alice’s exponent a, Bob’s exponent b Alice, a Bob, b g a mod p g b mod p Alice computes (g b ) a = g ba = g ab mod p Bob computes (g a ) b = g ab mod p Could use K = g ab mod p as symmetric key

Diffie-Hellman Subject to man-in-the-middle (MiM) attack Alice, a Bob, b g a mod p g b mod p Trudy, t g t mod p Trudy shares secret g at mod p with Alice Trudy shares secret g bt mod p with Bob Alice and Bob don’t know Trudy exists!

Diffie-Hellman How to prevent MiM attack? –Encrypt DH exchange with symmetric key –Encrypt DH exchange with public key –Sign DH values with private key –Other? You MUST be aware of MiM attack on Diffie- Hellman