Tag Info

Hot answers tagged

8

It's not a "one time pad" if you reuse the key. You lose the perfect security properties of a one time pad with any key reuse, period. Your scheme just reduces the security level of the algorithm to your "special calculation", which is simply security by obscurity.


5

As others have said, this is not a One-Time Pad algorithm. Your proposed algorithm is actually called a "code book"; the primary difference being that you are substituting one word for a random set of letters of the same length. Code books have a long, well-documented history, and are still in limited use today. If you look at some of the books on ...


4

They don't need your public key at all to decrypt. You need their public key to encrypt the message, which they decrypt with their private key. The only thing they need your public key for is to verify that the message comes from you. In that sense it doesn't make sense to attach your public key, unless, for instance, you plan to confirm fingerprints over ...


2

Encrypting the very first message sent from the client with the secret key would present significant issues for the Authentication Server. If this initial request were encrypted, the Authentication Server would not be able to determine which user made the request and therefore which secret key is needed to decrypt the same request. This cleartext ...


2

The standard protocol for using asymmetric cryptography is the following: Alice generates a public/private key pair Alice publishes her public key + additional steps if you need if you need proper authentication of the key Bob retrieves Alice's key (and authenticate it when possible) Bob crypts the message using Alice's public key Bob sends the encrypted ...


2

The registrar verifies the identity of the user (in a comment you said that the user is not anonymous towards the registrar). Identification means that each user has some kind of unique identifier. That could be their social security number, their real name + birthday + birthplace or something like that. The registrar uses a cryptographically secure hash ...


1

No, you cannot secure data completely if the user has total control of the system and its hardware (and possibly a lot of money; attacking hardware can get quite expensive). If this is just to prevent cheating, hardcoding the encryption key in an obfuscated manner (so that strings doesn't find it) should be enough though (any student breaking that probably ...


1

In the asymmetric encryption scheme you can achieve two things: message confidentiality : this is done by using someone's public key to encrypt a message. Only the owner of the private key can decrypt the message message authentication : this is done by using your own private key to sign a message. Anyone with the public key can verify the signature of the ...


1

The public key can be used to send an email securely to the holder of the corresponding private key, however the holder of the public key cannot ascertain that the message actually comes from you. Attaching your public key in the email though can problematic because he cannot verify that the public key attached actually belongs to you. If all he cares about ...


1

It turns out that this is pretty interesting stuff. From the Martin Kleppmann's blog "Improving the security of your SSH private key files" (Posted 2013-06-26. Archived here. HackerNews'd here): But how do you get from the passphrase to the AES encryption key? I couldn’t find it documented anywhere, so I had to dig through the OpenSSL source to find ...



Only top voted, non community-wiki answers of a minimum length are eligible