0
votes
2answers
61 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
0
votes
2answers
63 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
0
votes
1answer
43 views

Evaluation of cryptosystem for authentication and keyexchange

I'm a masters student in computer science who works part time with my own company as a consultant. My lastest project is based on my bachelor thesis which handles everything except the security. The ...
1
vote
2answers
204 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
1
vote
0answers
100 views

Does Diffie-Hellmann (DH) key exchange protocol lower Off-The-Record protocol (OTR) security level?

Off-the-Record protocol employes Diffie-Hellman key exchange protocol (DH). DH protocol does not provide authentication of the communicating parties and, according to many sources, is vulnerable to ...
1
vote
0answers
51 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
5
votes
2answers
686 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...
2
votes
3answers
619 views

Establish a secure channel with mutual authentication given pre-shared public keys

Suppose I have a system whereby parties are identified by their public key (with some pre-selected asymmetric key algorithm). Suppose I have a party PUB1 which wants to establish a secure channel with ...
5
votes
2answers
271 views

Authenticating client without hardcoding key?

A basic question, but I'm not a master and this is puzzling me- How is it possible to authenticate a client from the server's perspective? i.e. imagine you're the server, and you want to give the ...
6
votes
1answer
3k views

Ways to sign gpg public key so it is trusted?

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
5
votes
3answers
341 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
8
votes
3answers
513 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
9
votes
1answer
329 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
6
votes
2answers
565 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
6
votes
3answers
939 views

Using Secure Remote Password without sending the username in the clear

To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
5
votes
1answer
236 views

Using Secure Remote Password without embedding the modulus

The SRP protocol as described by the author assumes that the large safe prime modulus and generator are embedded into the client and server rather than being transmitted as part of the protocol. ...
8
votes
2answers
407 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...