New answers tagged

1

If your main objective is to ensure integrity and authenticity, and not confidentiality, it sounds like what you want is not encryption, but message authentication (symmetric, like HMAC) or a digital signature (asymmetric, like RSA). Since you mention third parties, it's likely that signing with an asymmetric system should be used, since with a symmetric ...


0

Is is difficult to to implement either? No not really, as long as you use a vetted and verified implemented library. AES is much faster than RSA, but as you only sign a hash the amount of data operated on should not be much of a concern. RSA (is that is the assym. alogrithm you wish to use) is 2048 (see) and 256 for AES. With AES you would probably want to ...


-2

Every operating system installer packages are signed. In Windows for example, when you download Firefox Installer Stub, you can check it's properties by right-clicking on the exe file and going to "Signature" tab: Then, click on "Details" to see more, you will see "Signer Information" and whatever it's "OK" which is checked with Windows built-in ...


1

The JDK is offered over HTTP because they also offer a hash for you to confirm over secure channels. Since the hash is over a secure channel, if that hash can't be confirmed you shouldn't use the download. The fact that the part of truth(the hash you check against) is delivered securely means they can offer it over HTTP because you will be able to securely ...


0

Firstly, you are right, it is a recursive problem. SSL is sort of a house of cards because you always have to trust something, including the folks that are telling you who to trust. A number of experts have predicted the collapse of SSL: Security Collapse in the HTTPS Market SSL/TLS encryption and the vacant lot scam: Too big to fail How is SSL ...


1

AFAIK, some of them are in countries, where single entity (gov) can covertly do whatever it wants on their machines. Yes, pretty many countries are like that today. Sadly, concerning governments, the CA system is not (and never was) secure. CAs are still good for preventing some people and organisations from attacking, just not all.



Top 50 recent answers are included