Generate Keys With Diffie Hellman

Posted : admin | On 11-05-2021

Aug 16, 2017 How to generate a notifications once Handbreak finished its current work? August (3) Enable TLS 1.1 and TLS 1.2 as a default secure protocols in WinHTTP; Security Hardening: Upgrade Diffie-Hellman Prime to 2048 bit on Windows Server; Change a SSL Certificate on Windows Server 2012 R2 Web Application Proxy; July (5). Diffie-Hellman is based on calculating discrete logarithms in a finite field. Diffie-Hellman public key cryptography is used by all major VPN gateway's today, supporting Diffie-Hellman groups 1,2 and 5. DH group 1 consists of a 768 bit key, group 2 consists of 1024 bit key and group 5 comes with 1536 bit key.

-->
  1. I'm trying to implement a diffie-hellman key exchange. Let's say I found a large prime number p - how can I find a generator g? Restricted by the multiprecision library that I have to use, only a few basic operations (+,., -, /, pow, modExp, modMult, mod, gcd, isPrime, genRandomPrime, genRandomBits, and a few more) are available.
  2. Diffie-Hellman key exchange (D-H) is a method to generate a private key between two machines connected through an insecure channel. When a client begins a connection to a secured web service the SSL negotiation occurs exchanging the public keys and then, the two parties comes into an agreement in regards to the keys and ciphers to be used during the communication.

Generating Diffie-Hellman Keys

To generate a Diffie-Hellman key, perform the following steps:

  1. Call the CryptAcquireContext function to get a handle to the Microsoft Diffie-Hellman Cryptographic Provider.

  2. Generate the new key. There are two ways to accomplish this—by having CryptoAPI generate all new values for G, P, and X or by using existing values for G and P, and generating a new value for X.

    To generate the key by generating all new values

    1. Call the CryptGenKey function, passing either CALG_DH_SF (store and forward) or CALG_DH_EPHEM (ephemeral) in the Algid parameter. The key will be generated using new, random values for G and P, a newly calculated value for X, and its handle will be returned in the phKey parameter.
    2. The new key is now ready for use. The values of G and P must be sent to the recipient along with the key (or sent by some other method) when doing a key exchange.

    To generate the key by using predefined values for G and P

    1. Call CryptGenKey passing either CALG_DH_SF (store and forward) or CALG_DH_EPHEM (ephemeral) in the Algid parameter and CRYPT_PREGEN for the dwFlags parameter. A key handle will be generated and returned in the phKey parameter.
    2. Initialize a CRYPT_DATA_BLOB structure with the pbData member set to the P value. The BLOB contains no header information and the pbData member is in little-endian format.
    3. The value of P is set by calling the CryptSetKeyParam function, passing the key handle retrieved in step a in the hKey parameter, the KP_P flag in the dwParam parameter, and a pointer to the structure that contains the value of P in the pbData parameter.
    4. Initialize a CRYPT_DATA_BLOB structure with the pbData member set to the G value. The BLOB contains no header information and the pbData member is in little-endian format.
    5. The value of G is set by calling the CryptSetKeyParam function, passing the key handle retrieved in step a in the hKey parameter, the KP_G flag in the dwParam parameter, and a pointer to the structure that contains the value of G in the pbData parameter.
    6. The value of X is generated by calling the CryptSetKeyParam function, passing the key handle retrieved in step a in the hKey parameter, the KP_X flag in the dwParam parameter, and NULL in the pbData parameter.
    7. If all the function calls succeeded, the Diffie-Hellman public key is ready for use.

  3. When the key is no longer needed, destroy it by passing the key handle to the CryptDestroyKey function.

If CALG_DH_SF was specified in the previous procedures, the key values are persisted to storage with each call to CryptSetKeyParam. The G and P values can then be retrieved by using the CryptGetKeyParam function. Some CSPs may have hard-coded G and P values. In this case a NTE_FIXEDPARAMETER error will be returned if CryptSetKeyParam is called with KP_G or KP_P specified in the dwParam parameter. If CryptDestroyKey is called, the handle to the key is destroyed, but the key values are retained in the CSP. However, if CALG_DH_EPHEM was specified, the handle to the key is destroyed, and all values are cleared from the CSP.

Exchanging Diffie-Hellman Keys

The purpose of the Diffie-Hellman algorithm is to make it possible for two or more parties to create and share an identical, secret session key by sharing information over a network that is not secure. The information that gets shared over the network is in the form of a couple of constant values and a Diffie-Hellman public key. The process used by two key-exchange parties is as follows:

  • Both parties agree to the Diffie-Hellman parameters which are a prime number (P) and a generator number (G).
  • Party 1 sends its Diffie-Hellman public key to party 2.
  • Party 2 computes the secret session key by using the information contained in its private key and party 1's public key.
  • Party 2 sends its Diffie-Hellman public key to party 1.
  • Party 1 computes the secret session key by using the information contained in its private key and party 2's public key.
  • Both parties now have the same session key, which can be used for encrypting and decrypting data. The steps necessary for this are shown in the following procedure.

To prepare a Diffie-Hellman public key for transmission

  1. Call the CryptAcquireContext function to get a handle to the Microsoft Diffie-Hellman Cryptographic Provider.
  2. Create a Diffie-Hellman key by calling the CryptGenKey function to create a new key, or by calling the CryptGetUserKey function to retrieve an existing key.
  3. Get the size needed to hold the Diffie-Hellman key BLOB by calling the CryptExportKey, passing NULL for the pbData parameter. The required size will be returned in pdwDataLen.
  4. Allocate memory for the key BLOB.
  5. Create a Diffie-Hellman public key BLOB by calling the CryptExportKey function, passing PUBLICKEYBLOB in the dwBlobType parameter and the handle to the Diffie-Hellman key in the hKey parameter. This function call causes the calculation of the public key value, (G^X) mod P.
  6. If all the preceding function calls were successful, the Diffie-Hellman public key BLOB is now ready to be encoded and transmitted.

To import a Diffie-Hellman public key and calculate the secret session key

Diffie Hellman Exchange

  1. Call the CryptAcquireContext function to get a handle to the Microsoft Diffie-Hellman Cryptographic Provider.
  2. Create a Diffie-Hellman key by calling the CryptGenKey function to create a new key, or by calling the CryptGetUserKey function to retrieve an existing key.
  3. To import the Diffie-Hellman public key into the CSP, call the CryptImportKey function, passing a pointer to the public key BLOB in the pbData parameter, the length of the BLOB in the dwDataLen parameter, and the handle to the Diffie-Hellman key in the hPubKey parameter. This causes the calculation, (Y^X) mod P, to be performed, thus creating the shared, secret key and completing the key exchange. This function call returns a handle to the new, secret, session key in the hKey parameter.
  4. At this point, the imported Diffie-Hellman is of type CALG_AGREEDKEY_ANY. Before the key can be used, it must be converted into a session key type. This is accomplished by calling the CryptSetKeyParam function with dwParam set to KP_ALGID and with pbData set to a pointer to a ALG_ID value that represents a session key, such as CALG_RC4. The key must be converted before using the shared key in the CryptEncrypt or CryptDecrypt function. Calls made to either of these functions prior to converting the key type will fail.
  5. The secret session key is now ready to be used for encryption or decryption.
  6. When the key is no longer needed, destroy the key handle by calling the CryptDestroyKey function.

Exporting a Diffie-Hellman Private Key

Generate Keys With Diffie Hellman Youtube

To export a Diffie-Hellman private key, perform the following steps:

  1. Call the CryptAcquireContext function to get a handle to the Microsoft Diffie-Hellman Cryptographic Provider.
  2. Create a Diffie-Hellman key by calling the CryptGenKey function to create a new key, or by calling the CryptGetUserKey function to retrieve an existing key.
  3. Create a Diffie-Hellman private key BLOB by calling the CryptExportKey function, passing PRIVATEKEYBLOB in the dwBlobType parameter and the handle to the Diffie-Hellman key in the hKey parameter.
  4. When the key handle is no longer needed, call the CryptDestroyKey function to destroy the key handle.

Generate Keys With Diffie Hellman Wife

Example Code

Generate Keys With Diffie Hellman

Generate Keys With Diffie Hellman Songs

The following example shows how to create, export, import, and use a Diffie-Hellman key to perform a key exchange.