Public key validation

As explained in Real-World Cryptography

Public key validation is the process of checking that a received public key is a valid element of the intended cryptographic group.

Public key validation checks that a received public key belongs to the intended cryptographic group. Without it, a malicious Diffie–Hellman key can place the exchange in a small subgroup and reveal information about the private key. section 5.4

A basic validation check works as follows:

• Raise the received public key to the order of the intended subgroup. section 5.4
• Accept it only when the result is the identity element, showing that the key belongs to that subgroup. section 5.4
• For elliptic curves, also account for invalid-curve attacks: prime-order groups do not automatically eliminate validation risks. section 5.4

A one-bit leak

An attacker sends a malicious public key from a small subgroup. The shared secret becomes 1 when the private key is even and −1 when it is odd, revealing its least significant bit; repeated attacks can expose more. section 5.4

Figure 5.15 A small subgroup attack impacts DH groups that have many subgroups. By choosing generators of small subgroups as public keys, an attacker can leak bits of someone’s private key little by little.

Visualizes how choosing small-subgroup generators as public keys leaks private-key bits incrementally. section 5.4

How Real-World Cryptography covers it

How deep it goes

Explains the subgroup-order test and its identity-element result, then warns that elliptic curves still require invalid-curve defenses.

Examples

Uses malicious subgroup public keys, even-or-odd private keys, subgroup-order exponentiation, and the identity element.

What it assumes

Assumes basic Diffie–Hellman, private keys, public keys, subgroups, and identity elements.

What you can do after

Operate/configure Diffie–Hellman implementations by requiring public-key validation and checking elliptic-curve handling.

How it connects

Connects public key validation with Diffie–Hellman, small subgroup attacks, invalid curve attacks, and elliptic curves.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• small subgroup attackaddresses · A small subgroup attack sends public keys from small subgroups to expose information about a victim's private key through the resulting shared secrets.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.