In this article, we demonstrate a subtle but devastating backdoor in finite-field Diffie–Hellman. By computing public keys modulo $p^2$ instead of $p$ while restricting the secret exponent to $x \leq p-1$, the discrete logarithm becomes efficiently recoverable using Fermat quotients. We show the full derivation and provide a working Sage implementation. Backdoors are always bad — but they are catastrophic when they are embedded in a fundamental primitive like Diffie–Hellman key exchange. If your browser shows a green lock, you assume your connection is secure. But what if the implementation of Diffie–Hellman contains a tiny change that looks harmless in code review — and yet allows an attacker to recover the private exponent in milliseconds? In this post I’ll show a nasty little backdoor that requires only a tiny modification: using a modulus of $p^2$ instead of $p$, while keeping the secret exponent bounded by $p$ This ...
My name is Christian Schridde and i am living in Germany. I made my PhD in cryptography at the University of Marburg. Meanwhile i am for the Federal Office for Information Security.
I write this blog just for fun and my native interest in all those covered topics.
RFAEMUFPHZL - CWBYAHUQNBL - MIZCEALCULK - ELYOIECBAQK - BERLINCLOCK
ReplyDelete