New answers tagged key-exchange
Checking manual page for ssh-keygen gives hints about generating and verifying the parameters (moduli file): ssh-keygen -G moduli-2048.candidates -b 2048 ssh-keygen -T moduli-2048 -f moduli-2048.candidates which sounds for me like a proven way of doing this. But I also discourage you from doing that. The examples what can go wrong are answered in related ...
Thanks to @StackzOfZtuff for the linked articles. Using those, this is what I've pieced together by now: The generated parameters can probably be trusted as long as they are regenerated frequently. For a higher security, one would have to check for reused parameters, which could be a sign that something fishy is going on. It's still safer to generate ...
Problem with A - Anyone with access to the server can decrypt the message because a copy of all symmetric keys is stored on the server. Plaintext of message may be stored in server RAM temporarily when re-encrypting message Problem with B - Why not immediately Bpk(Message)? Why use an additional session key Ka-b(message), Bpk(Ka-b). For both methods, B is ...
If you can package the client with certificates, I suggest using TLS/SSL for your message encryption. Just package each client with the certificate(s) for your server(s) and you'll be able to verify communications with the correct server and that the messages are encrypted.
Top 50 recent answers are included