Key exchange protocols

learn more… | top users | synonyms

1
vote
1answer
6k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
1
vote
1answer
263 views

Secure Encrypted Chat Protocol [duplicate]

Possible Duplicate: Is there a way to negotiate a secret between 2 parties with no prior knowledge? Imagine two clients who want to establish a secure connection over a server. Both clients ...
0
votes
3answers
2k views

Are there flaws in this simple key exchange?

I'm reviewing for a computer security exam. Here is a simple scenario: Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. ...
0
votes
1answer
105 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
0
votes
1answer
645 views

rolling code & keyless entry system [closed]

The security industry typically uses rolling code algorithms to authenticate sender & receivers in keyless entry systems, which is called RKE (ex: KeeLoq). In key-less smart key car system, The ...
0
votes
1answer
104 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
0
votes
1answer
112 views

How could SSL certificate affect the symmetric key length?

This article in GoDaddy support knowledge base says All of our SSL certificates support high-grade 256-bit encryption How would they not support it? The SSL certificate contains keys for ...
0
votes
1answer
71 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
0
votes
2answers
131 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
0
votes
1answer
641 views

Is the Station-to-Station protocol secure?

After I've read a lot about key exchange many sources state that the Station-to-Station is secure, since it also verifies the entity on the other side. Well how is that true, if an active Man in the ...
0
votes
2answers
89 views

does a public key work with all encrypted programs

let us say, I use program "x" for my e-mail security. through them I have a public key and a private key. My friend uses program "y" for their e-mail security and consequentially have a public key ...
0
votes
1answer
163 views

Purpose of key confirmation

Among the requirements for a secure key exchange is the key confirmation. I wonder why is this step required. Even if the other party hasn't computed a correct value for the shared secret, it doesn't ...
0
votes
1answer
39 views

Sharing Derived Unique Key Per Transaction (DUKPT) Base Derivation Key (BDK) with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
0
votes
1answer
49 views

Security without TLS certificates

after getting an answer to Security over multi-streaming such as SCTP i have found that i do not have the capacity to give a public key or certificate to the other end securely (to be sure MitM cannot ...
0
votes
1answer
48 views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
0
votes
2answers
78 views

Is End to End security possible without physical contact?

I noticed that a lot of messaging start to provide "End2End" security, but I wonder how this can be possible without a key exchange between the the two clients. To my understanding to provide real ...
0
votes
1answer
61 views

Is it possible to perform one-way OTR MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
0
votes
1answer
161 views

Key Exchange using RSA

I'm trying to do key exchange using the following scheme. Server generates an RSA-2048 key pair and sends the public part to the client Client generates an RSA-592 key pair (I have to use RSA-592 ...
0
votes
1answer
136 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
2answers
207 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
0
votes
1answer
161 views

Key-Exchange Algorithms VS Local Key Generation?

I was wondering the difference in term of Security, Computational cost and Network overhead between the use of : A Key-Exchange Algorithm (e.g. Diffie–Hellman) to set up a symmetric key. The ...
0
votes
1answer
99 views

Key Exchange algorithm to be used for REST framework

I was required to create key exchange module for custom Rest framework which supports document level security in REST requests. Framework has its own security module which allows to encrypt parameter ...
0
votes
3answers
251 views

What are the MitM implications of a stolen client-side private key?

Many VoIP handsets support client-side SSL authentication for auto-provisioning. Unfortunately, some devices must be programmed with their client-side keys. (Keys generated on low-entropy devices are ...
0
votes
0answers
28 views

Distribution of key by server

I have read that in asymmetric cryptography, a system admin can generate key pairs on the server. After that, the users will be given the generated key pairs and this is an efficient way of doing this ...
0
votes
0answers
30 views

Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to ...
0
votes
0answers
103 views

ElGamal for ECC - Not working with Edwards curves (ed25519)

I know the usual way of using encryption/decryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two p256-keypairs. With ...
0
votes
1answer
157 views

In IKE protocol; what is the PRF? [duplicate]

In IKE protocol; what is the PRF ? What is "the generation of a key based on modeled random oracle hash functions"?
-1
votes
1answer
184 views

Theorical question on encryption methods [duplicate]

Possible Duplicate: Encryption strategies for multi users access in production systems I would like to develop a service on wich clients would connect and retrieve informations. These ...
-2
votes
1answer
910 views

GPG advantages / disadvantages, is it useful or secure? [closed]

I thinking about GPG, is very widely used, but is secure? Why and where we using GPG? I found an article from 2002, but is very old.
-2
votes
2answers
167 views

Understanding a key establishment protocol

I'm studying a one-pass key establishment protocol. Let be A client and B the Server. A sends to B: E_w(t,b,k) where t is a timestamp requested for freshness, k is the ephemeral key that will be ...
-2
votes
2answers
212 views

How do certificates stop this man in the middle attack?

Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them. The communication goes as follows: ...