Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

learn more… | top users | synonyms

178
votes
8answers
81k views

Why not use larger cipher keys?

RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
103
votes
6answers
71k views

“Diffie-Hellman Key Exchange” in plain English

Can someone explain to me what Diffie-Hellman Key Exchange is in plain English? I have read in a non-tech news page that Twitter has just implemented this technology which allows two persons to ...
42
votes
4answers
5k views

Why is key exchange necessary at all?

Let's say "Alice" and "Bob" want to communicate with each other over an insecure network. Using Diffie–Hellman key exchange, they can get the same symmetric key at last. However, as I understand, ...
34
votes
7answers
4k views

How dangerous might be publishing a public key?

Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system? I know public keys are meant for encrypting messages by anyone ...
24
votes
5answers
4k views

Why is Bruce Schneier recommending symmetric crypto over public key crypto

I just read the article written by Bruce Schneier, the crypto guru. In the article, he says : Prefer symmetric cryptography over public-key cryptography. But, he doesn't shed any light as to ...
21
votes
3answers
9k views

What specific padding weakness does OAEP address in RSA?

It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks. Can someone elaborate this in better detail? I'd specifically like to know the ...
18
votes
6answers
3k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
11
votes
2answers
2k views

What asymetric scheme provides the shortest signature, while being secure?

I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties : Be asymmetric (one ...
11
votes
1answer
3k views

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
11
votes
1answer
371 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
11
votes
0answers
481 views

Strength and length of Symmetric vs Asymmetric keys [duplicate]

There are many questions surrounding the differences between symmetric and asymmetric encryption keys. I think I've read them all at this point. But I'm still left wondering: Why does a "secure" ...
9
votes
3answers
17k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
8
votes
4answers
886 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
8
votes
3answers
1k views

Is it possible to prove which public key was used to encrypt a message?

Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the ...
8
votes
2answers
824 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
7
votes
3answers
1k views

What are the disadvantages of using public key cryptography when encrypting files? [duplicate]

I am wanting to encrypt a file with my public key, my friend told me that this is not a good idea but did not explain why. Can someone explain please.
7
votes
2answers
237 views

Can symmetric key cryptography provide identification?

I understand that PKI uses digital certificates to link a public key to an entity, but is there anything similar for symmetric cryptography. If, theoretically, PKI didn't exist, how do you know you ...
7
votes
5answers
191 views

Secure application data transmission via SMS channel

There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from. While there's ...
6
votes
5answers
24k views

Is there a simple example of an Asymmetric encryption/decryption routine?

I can understand Java, Perl and JavaScript code very well. The rest, I have not studied, but I guess I could figure out how to read/translate. I would like to know what the simplest of Asymmetric ...
6
votes
2answers
12k views

How X509 Certificates are used for Encryption

I have small doubt regarding the process of X509. I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
5
votes
2answers
4k views

What asymmetric encryption algorithms are in common use beside RSA?

I am looking for an asymmetric encryption algorithm other than RSA?
5
votes
1answer
357 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
5
votes
3answers
162 views

Public Key Encryption instead of passwords

As an alternative to using passwords, customers could be provided with individual asymmetric-encryption key pairs (i.e. a private key with associated public key), which could be used to validate their ...
5
votes
1answer
2k views

How secure is GPG symmetric encryption?

Since I am new to encryption and have recently been losing stuff, I decided to start a file that contains some passwords for online accounts and whatnot, encrypt it, back it up (and keep a single copy ...
4
votes
3answers
3k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
4
votes
2answers
5k views

Shared Secret, is it a public key or a private key?

Reading the Diffie-Hellman non mathematical explanation i found that some mathematical operations are performed on private-key and the recipient's public key to generate a "shared secret" on both ends ...
4
votes
3answers
342 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
4
votes
1answer
256 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
4answers
1k views

Is asymmetric encryption ever recommended for long-term storage?

Is asymmetric encryption ever recommended for long-term storage of data, is it advisable for example to store data in a database such that: 1) A user enters data on a website, it is encrypted using a ...
3
votes
7answers
382 views

How would I give an encryption key to only one person?

Let's say I have an encrypted message. I want to make it so that someone is able to decrypt it. The only way of giving it to them is online. For the purposes of this question, I can't call, mail or ...
3
votes
4answers
1k views

Asymmetric crypto: Decrypt own messages without having private key

I have built a messages system for my website. Users can send the admin messages which are stored in the DB after being AES-encrypted. I think that using asymmetric crypto (RSA through openssl) ...
3
votes
5answers
142 views

Is it secure to ship public key with license file?

I've implemented a licensing client and server for our web-applications. Currently there is only one way for licensing an app, user should manually upload the license file using specified form and ...
3
votes
2answers
211 views

Why can I sign but not encrypt?

-edit- After following a chain of links from this question I see this is similar/duplicate of Why should one not use the same asymmetric key for encryption as they do for signing? but this question ...
3
votes
3answers
698 views

Why do you need to encrypt symmetric key?

I'm reading this pki article and as you can see near the bottom, the quick animation and description: The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
3
votes
2answers
877 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
3
votes
1answer
1k views

How large RSA-keys could the worlds combined computer power factorize in reasonable time?

If you combined every microprocessor on earth into one humongous computational cluster, how large RSA-keys could you factor in reasonable time (lets say a few years)? I know from reading the answers ...
3
votes
1answer
161 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
3
votes
1answer
1k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
3
votes
0answers
76 views

Security of the shared secret key for a smart meter (Linky) [closed]

Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC ...
3
votes
0answers
158 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
2
votes
5answers
2k views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
2
votes
3answers
4k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
2
votes
1answer
10k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
2
votes
1answer
118 views

What keeps the private key safe if an attacker has both clear and encrypted copies of a message and the public key?

Let's say someone obtained a message in both clear text and in its encrypted copy with asymmetric cryptography, like RSA-2048. He also has the public keys. Is the private key still undiscoverable? ...
2
votes
1answer
106 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
2
votes
1answer
44 views

Use asymmetric encryption once to exchange symmetric key

I'm developing a json API that should be able to handle a huge amount of clients. To make this work I need to reduce the overhead as far as possible. One of the ideas I have is to use https only in ...
2
votes
1answer
5k views

How to encrypt a short string to a short ciphertext using an asymmetric encryption?

I am using RSA to encrypt some text, so my system has already generated private and public keys. These keys I would like to use to encrypt/decrypt a short text (16 chars). The main condition is: ...
2
votes
2answers
1k views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
2
votes
1answer
46 views

What does it mean to sign a public key and what's wrong with signing someone else's key?

I just stumbled upon this comic and I'm not sure if I understand what's going on. I googled and I figured that somehow people can sign other people's public keys and then they that person is ...
2
votes
1answer
210 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...