Key exchange protocols

learn more… | top users | synonyms

175
votes
8answers
15k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
8
votes
2answers
388 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...
2
votes
1answer
214 views

Any obvious flaws in this protocol?

Are there any particular flaws in this protocol? (Yes I know about SSL) Three participants: Login Server LS Game Server GS Client C Asymmetric key-pair Kpriv Kpub Shared 128bit secret key Ksec ...
4
votes
2answers
215 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
27
votes
3answers
8k views

Is there any particular reason to use Diffie-Hellman over RSA for key exchange?

I often see RSA being recommended as a method of key exchange. However, the Diffie-Hellman key exchange method appears to be secure as well. Is there any considerations one should take into account ...
5
votes
1answer
6k views

How to implement an API-Key-Mechanism

first of all: I am quite unsure about the questions title, so if you have a better idea, please feel free to tell (: I would like to know about best-practise examples where services (like Twitter or ...
1
vote
1answer
127 views

Is there a known vetted alternative to this key-exchange protocol?

I have three participants: A client A in possession of the public key Kpub A login server S in possession of the private key Kpriv Game servers B (B1, B2 etc) S and all B may share a finite number ...
8
votes
3answers
440 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
6
votes
2answers
497 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
3
votes
3answers
221 views

Does the hash change the security of the Secure Remote Password protocol?

I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
0
votes
2answers
138 views

How do key servers resolve conflicts?

According to the PGP network FAQ While a number of key servers exist, it is only necessary to send your key to one of them. The key server will take care of the job of sending your key to all ...