Tag Info

Hot answers tagged

34

So, if you're downloading a file from what is effectively an unauthenticated source, and validating it with a hash from the same source (or even another unauthenticated source), what is the real value of hashing the file? The provided hash lets you double-check that the file you downloaded was not corrupted accidentally in transit, or that the file you ...


30

It pays to investigate what we really trust in hand-written signatures. A signature is the physical manifestation of the will of the signer to acknowledge the contents of what is signed. Most legal systems define that a signature is yours and is binding if and only if "you really did it". This looks like a tautology, but it actually is quite profound: the ...


26

To complement the good answer from @D.W.: for password hashing, MD5 is no more broken than any other hash function (but don't use it nonetheless). The full picture: MD5 is a cryptographic hash function which, as such, is expected to fulfill three characteristics: Resistance to preimages: given x, it is infeasible to find m such that MD5(m) = x. ...


24

In a sane organization, it is actually necessary to have two distinct keys, one for signing and one for encryption. When you receive some encrypted data (e.g. an encrypted email, as in S/MIME or PGP), you normally store the encrypted data (that's what happens by default for email). Therefore, if your private key becomes "unavailable", you cease to be able ...


23

Non-repudiation is about having a proof that the announced author really wrote the message -- and such the proof can be verified even without the consent of the said author: the author must not be able to repudiate his message. This calls for asymmetric cryptography (since verification can be done without the author consent, it cannot use whatever secret ...


22

What do you mean "prohibited"? Who would "prohibit" use of MD5? It's not like we have some International Crypto Cops who go arrest people who use ROT13 and other insecure crypto schemes. Or, to be a bit more serious: cryptographers already recommend that new systems should avoid MD5, and they recommend that existing systems should migrate away from MD5. ...


22

There is more than one reason: 1) Actually the RSA algorithm is slower. For instance: By comparison, DES (see Section 3.2) and other block ciphers are much faster than the RSA algorithm. DES is generally at least 100 times as fast in software and between 1,000 and 10,000 times as fast in hardware, depending on the implementation. Implementations of the ...


22

It is mostly that the management approaches and timeframes differ for the use of signing and encryption keys. For non-repudiation, you never want someone else to get control to your signing key since they could impersonate you. But your workplace may want to escrow your encryption key so that others who need to can get to the information you've encrypted. ...


19

No. Digital signatures are not sufficient for non-repudiation -- not by a long shot. Non-repudiation is a legal concept. It means that, if there is a dispute, in a lawsuit it will be possible to hold one party to their commitments. For example, mathematical schemes that claim to provide non-repudiation have to withstand the "jury attack". Some expert ...


17

If there is no real need for security, then here is a very fast serial number generator, with a checker: User a counter. Initialize it at 0. When you want a new serial number, increment your counter by 1000; the new counter value is the serial number. The checker works like this: a serial number is valid if it ends with three zeros. Only one of every 1000 ...


17

I understand your question as follows: there is a tangible device which may produce data and send it over radio (Bluetooth); and another device (say, a smartphone) which receives said data, and displays it; the problem being that the second device cannot be trusted. So the question is: can we do something about it, so that we may gain some confidence in the ...


16

A good example is the flaw on CBC, demonstrated within SSL and in particular for password recovery in a IMAP-over-SSL setup. See for details. Briefly speaking, SSL has a MAC, but a small part of it was doing things with the received encrypted data after decryption but before verifying the MAC. Namely, the receiving system was decrypting the data, checking ...


16

The fingerprint, as displayed in the Fingerprints section when looking at a certificate with Firefox or the thumbprint in IE is the hash of the entire certificate in DER form. If your certificate is in PEM format, convert it to DER with OpenSSL: openssl x509 -in cert.crt -outform DER -out cert.cer Then, perform a SHA-1 hash on it (e.g. with sha1sum1): ...


13

It is potentially insecure to use the same keypair for both signing and encryption. Doing so may enable attacks, depending on the particular public-key scheme you use. This kind of use is not what the system was designed for, so using the system in a way it was not designed "voids the warranty". Don't do it. It's asking for trouble.


13

For symmetric algorithms (symmetric encryption, Message Authentication Code), a key is a sequence of bits, such that any sequence of the right length is a possible key. For instance, AES is a symmetric encryption algorithm (specifically, a block cipher) which is defined over keys of 128, 192 and 256 bits: any sequence of 128, 192 or 256 bits can be used as a ...


12

The benefit there is indeed limited. As you pointed out, if you can replace one thing on a site, you can probably replace both. This does, however, have some benefits: It allows other sites to host large files with verified integrity. With that I can grab the file from some random 3rd party who I have no reason to trust and still verify that it is a good ...


12

Yes. This is an issue with any crypto system that does not protect integrity, such as with a signature or hmac. You see, encryption and decryption are just mathematical operations. You can always perform a mathematical operation on a blob of binary data, and will always get a result. Encrypting an decrypting operations do not error out because the data is ...


11

Strictly speaking, the use of the term "signature" about HMAC is improper; it is widespread, but still incorrect: signatures are about asymmetric algorithms with a public and a private key, such as RSA. HMAC uses a secret key (i.e. a bunch of arbitrary bytes) which is used for computing the MAC and for verifying it (it is actually verified by recomputing ...


11

There are a few confusions in your post. First of all, HMAC is not a hash function. More about HMAC later on. Hash Functions A hash function is a completely public algorithm (no key in that) which mashes bit together in a way which is truly infeasible to untangle: anybody can run the hash function on any data, but finding the data back from the hash output ...


11

If the signature algorithm is any good (and used properly with large enough keys which were generated in a correct and suitably random way), then, in practice, the answer is no: having access to many existing signatures does not allow the attacker to forge new ones, let alone recompute the private key. From a theoretical point of view: most (actually all) ...


11

You cannot have a secure signature scheme in less than 50 bits. Demonstration: the attacker can just enumerate all sequences of 50 bits until a match is found. Indeed, one point of digital signatures is that the verification algorithm can be computed by just everybody, since it uses only the public key (which, by definition, is public). Best you can hope, ...


10

As stated, that policy is weird. For a true digital signature (as in RSA or ECDSA), the message to be signed is first hashed, and the rest of the operation uses the resulting hash value only. The hash computation uses only public elements; there is no key in the hash. Therefore, requiring part of the hash computation to be performed on the smartcard makes ...


10

Citing from Smart card handbook By Wolfgang Rankl, Wolfgang Effing The HASH option of the PERFORM SECURITY OPERATION command can be used to compute a hash value. The command may transfer either the data to be hashed or a hash value already computed outside the smart card along with the data needed for the final step of the computation. In the latter ...


10

In security, attacks are generally divided into two categories: Opportunist attacks and targeted attacks. The former are generally low-effort and low intelligence (ie, no specific information or recon on the target), the latter have to be assumed to be motivated, well-equipped, and intelligent. The broader issue behind this question is: Does obscurity do ...


10

Encryption and signatures are two distinct activities, and the difference matters a lot in that respect. Encryption is about maintaining data confidentiality, except for "authorized users". When these users have private keys, encryption is said to be "end-to-end" in that the decryption will occur on the recipient's device, and can be done only with the help ...


9

Using different keys for signing and encryption is quite common. Make sure to flag the keys appropriately. A dedicated signing key, however, will offer no real protection against a rogue administrator. The admin is able to manipulate the application that is doing the signing. Note this is even true for smartcard: The administrator can manipulate the ...


9

PGP signatures are used to sign software packages in some Linux distributions, including Debian and Ubuntu. This is quite widespread, although most Linux users are never aware of it. PGP encryption, for what is was meant initially (i.e. emails), is commonly used in commercial situations, where some parties wish to exchange work documents. PGP keys are thus ...


9

OK, the answer so far are fundamentally on track, but I'm going to try to take your questions as they came in: * where did this public key come from? A public key is part of a two key pair used in assymetric cryptography. There are many encryption algorithms out there, but boils down to a public key and a private key which are mathematically linked. They ...



Only top voted, non community-wiki answers of a minimum length are eligible