Mastodawn

how diffie hellman key exchange works

(with as little math as possible)

@b0rk Nice! You actually need one more fact: an attacker can't be able to, given S o A and S o B, find (S o A) o B.

Of course, if you can find B given S o B, you can do this; however the converse is not true in general (but may be in concrete cases). So in a way, the DH problem is likely easier than the DL problem, and is probably the real fact that needs to be hard.

However, if you were to put that in panel 2, you'd already be giving away too much there... organizing things well is hard to impossible.

Show thread

Julia Evans 1d ago

@divVerent ah yeah good point! do you know an example offhand where you can find (S o A) o B given S o A and S o B? (but not find B given S o B)

Show thread

divVerent

@b0rk No such groups are known yet. However one can easily prove that discrete log solves CDH, whereas no general reduction from CDH to discrete log exists, which in a way tells that DL is a "harder or equivalent" problem.

There exists however such a reduction for some elliptic curves (e.g. the NIST curves and Curve25519); these curves are usually preferred, as we then only depend on one problem being hard.