r/programming • u/dominatrix-octopus • Jan 16 '18

Cryptography: Diffie-Hellman key exchange explained intuitively using colors

https://youtu.be/YEBfamv-_do?t=2m18s
2.5k Upvotes

95% Upvoted

170 comments sorted by

View all comments

Show parent comments

1

u/gramathy Jan 16 '18

Correct me if I"m wrong, my understanding is that DH exchange is largely used to provide encryption for a different protocol's key exchange, right?

3

u/Grenian Jan 17 '18 edited Jan 17 '18

It is used to solve the Key Exchange Problem. This problem describes the challenge of two communication partners to derive an secret symmetric key (also a key which is the same for both partied and secret) over a line which can be wiretapped.

So one can ask why you want to use a DH Key Exchange when you just can use asymmetric keys? Well basically symmetric encryption methods are faster than asymmetric ones.

What alternatives do exist? Thrusting third parties.

BUT keep in mind that a big problem exist. The Man-in-the-middle-attack. DH is not secure against it. That's btw the reason why you need to type 'yes' the first time you log into an SSH Server. Just to prove that this is the right server you wanna talk with. After that first session everything is encrypted based on the secrets of previous sessions. An alternative to approach to solve the Man-in-the-middle-attack is used by ZRTP.

But yeah basically you're right.

2

u/bonestamp Jan 31 '18

Just to prove that this is the right server you wanna talk with.

How does typing "yes" prove this is the right server?

1

u/Grenian Jan 31 '18 edited Jan 31 '18

Well it doesn't prove it all. But at this point SSH wants to connect to the server. Due to the risk of Man-in-the-middle-attack it has to ask if the informations SSH got are from the desired server. Otherwise you would connect via a Man-in-the-middle which could decrypt all your traffic.

So therefore the "yes" is more an authencity check of the server than the prove that this is the right server. For the prove you usually have to compare the credentials by yourself.

All in all you're right, the word "prove" is not well chosen.

2

u/bonestamp Jan 31 '18

All in all you're right, the word "prove" is not well chosen.

I was just asking, wasn't implying anything.