The tag has no wiki summary.

learn more… | top users | synonyms

156
votes
8answers
67k views

Why not use larger cipher keys?

RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
32
votes
7answers
4k views

How dangerous might be publishing a public key?

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone ...
23
votes
5answers
3k views

Why is Bruce Schneier recommending symmetric crypto over public key crypto

I just read the article written by Bruce Schneier, the crypto guru. In the article, he says : Prefer symmetric cryptography over public-key cryptography. But, he doesn't shed any light as to ...
19
votes
6answers
10k views

“Diffie-Hellman Key Exchange” in plain English

Can someone explain to me what is Diffie-Hellman Key Exchange in plain English? I have read in a non-tech news page that twitter has just implemented this technology which allows two persons to ...
15
votes
6answers
2k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
13
votes
3answers
3k views

What specific padding weakness does OAEP address in RSA?

It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks. Can someone elaborate this in better detail? I'd specifically like to know the ...
8
votes
4answers
735 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
7
votes
2answers
669 views

What asymetric scheme provides the shortest signature, while being secure?

I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties : Be asymmetric (one ...
7
votes
3answers
648 views

Is it possible to prove which public key was used to encrypt a message?

Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the ...
6
votes
1answer
1k views

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
5
votes
2answers
2k views

What asymmetric encryption algorithms are in common use beside RSA?

I am looking for an asymmetric encryption algorithm other than RSA?
5
votes
1answer
288 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
4
votes
5answers
14k views

Is there a simple example of an Asymmetric encryption/decryption routine?

I can understand Java, Perl and JavaScript code very well. The rest, I have not studied, but I guess I could figure out how to read/translate. I would like to know what the simplest of Asymmetric ...
4
votes
3answers
2k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
4
votes
2answers
2k views

Shared Secret, is it a public key or a private key?

Reading the Diffie-Hellman non mathematical explanation i found that some mathematical operations are performed on private-key and the recipient's public key to generate a "shared secret" on both ends ...
4
votes
3answers
258 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
4
votes
2answers
5k views

How X509 Certificates are used for Encryption

I have small doubt regarding the process of X509. I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
4
votes
1answer
238 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
4answers
820 views

Is asymmetric encryption ever recommended for long-term storage?

Is asymmetric encryption ever recommended for long-term storage of data, is it advisable for example to store data in a database such that: 1) A user enters data on a website, it is encrypted using a ...
4
votes
1answer
87 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
3
votes
7answers
264 views

How would I give an encryption key to only one person?

Let's say I have an encrypted message. I want to make it so that someone is able to decrypt it. The only way of giving it to them is online. For the purposes of this question, I can't call, mail or ...
3
votes
3answers
8k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
3
votes
3answers
244 views

Why do you need to encrypt symmetric key?

I'm reading this pki article and as you can see near the bottom, the quick animation and description: The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
2
votes
5answers
572 views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
2
votes
3answers
2k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
2
votes
2answers
122 views

Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft

Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes ...
2
votes
1answer
2k views

How to encrypt a short string to a short ciphertext using an asymmetric encryption?

I am using RSA to encrypt some text, so my system has already generated private and public keys. These keys I would like to use to encrypt/decrypt a short text (16 chars). The main condition is: ...
2
votes
1answer
635 views

How large RSA-keys could the worlds combined computer power factorize in reasonable time?

If you combined every microprocessor on earth into one humongous computational cluster, how large RSA-keys could you factor in reasonable time (lets say a few years)? I know from reading the answers ...
2
votes
1answer
52 views

Is there any asymmetric scheme provides signature with length of 30 bytes?

I want to send short messages to cell phones.Commonly a short message is no longer than 70 bytes. I need 20 bytes or more holding information and the rest bytes are for signature provided by ...
2
votes
1answer
396 views

How can I secure IP Multicast traffic?

I'm interested in securing IP Multicast traffic for content that will be sent globally with several low bandwidth receivers. I understand that simplified Broadcast encryption takes N public keys ...
2
votes
1answer
66 views

Reducing asymmetric authorization token size

I would like to use an asymmetric rather than symmetric signature for authorization, since I don't want a compromised service being able to forge authorization tokens (obviously). An authorization ...
2
votes
0answers
86 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
1
vote
3answers
631 views

Why is RSA decryption slow?

I've been researching the disadvantages of using RSA for encryption, and one I've found repeatedly is that RSA decryption is slow, but I haven't seen an explanation as to why this is. Can anyone ...
1
vote
2answers
180 views

Can any asymmetric algorithms work with only a key-sized amount of randomness?

With 397 rolls of a fair 6-sided die (not my favorite use of time, but certainly not infeasible), I could generate more than 1024 random bits. Could I use those bits to generate a keypair that could ...
1
vote
2answers
626 views

How to store Encryption Key on Shared Hosting?

I am currently designed Simple Online Patient Management System, but according to country Rule, sensitive data should be encrypted when used online, I did the encryption, and all sensitive fields ...
1
vote
1answer
79 views

What keeps the private key safe if an attacker has both clear and encrypted copies of a message and the public key?

Let's say someone obtained a message in both clear text and in its encrypted copy with asymmetric cryptography, like RSA-2048. He also has the public keys. Is the private key still undiscoverable? ...
1
vote
1answer
520 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
1
vote
2answers
55 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
1answer
69 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
1
vote
2answers
108 views

If I change any character in a private PEM, should the public PEM be different?

I'm generating a public PEM-format key from a private PEM-format key. I noticed that if I change a few characters near the end of the private PEM that the public PEM generated from the modified ...
1
vote
2answers
6k views

Encrypting string in javascript and decryption in java

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want ...
1
vote
1answer
985 views

Asymmetric crypto to store credentials in HTML LocalStorage

We are developing a Mobile web app where the users want (and it is a non relaxable requirement) to be logged for a very long time. The solution we are developing has a web-client part in HTML+JS and ...
1
vote
1answer
67 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
1
vote
1answer
997 views

How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a ...
1
vote
1answer
88 views

All users can write only one can read system

The system I want to implement has the following requirement: All users can insert some sensitive data, but only one, master user, can see it. There is any known, already implemented solution to this ...
1
vote
0answers
42 views

SSL Asymmetric encryption newbie [duplicate]

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I ...
1
vote
1answer
28 views

Encrypting multiple blocks with an asymmetric scheme

I have a general question how asymmetric schemes are usually implemented. Typically, there is a parameter in an asymmetric scheme which limits the message length. For example the modulus in RSA. I ...
0
votes
1answer
954 views

ECDH is better than plain RSA? [closed]

RSALabs recommend using at least 4096 bit long RSA keys to encrypt emails but we have some performance difficulty with 4096 RSA. my noob question is what is ECDH (i didn't understood from wikipedia ...
0
votes
1answer
699 views

Can I ensure that a public key derived from a private key is unique?

In asymmetric cryptography, is it possible to ensure that public key derived from a given private key is unique, no matter the algorithm?