Timeline for Prevent or detect key copy
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 10, 2015 at 17:01 | comment | added | user91560 | No, if attacker steals key user might not even detect it so we don't want that. Check the solution with IP addresses I mention in question - that solves our issue, but you need static IPs. I am looking for similar solutions (you may also want to modify your answer which mentioned authentication is not provided using symmetric crypto) | |
| Nov 10, 2015 at 16:45 | comment | added | Matthew | Yes, I addressed that - "if a user calls and says their private key has been stolen, you simply stop accepting that key" - this is the same as for a HMAC. You can't have a method which is entirely automatic. At some point, someone needs to be aware that the key has been duplicated, and that can't be achieved from the other end of the network connection. | |
| Nov 10, 2015 at 16:40 | comment | added | user91560 | You can use HMAC for authentication - en.wikipedia.org/wiki/Hash-based_message_authentication_code. If keys are stolen, similarly with PKI attacker can generate signature. Check my updated question - about IP approach to see what I mean | |
| Nov 10, 2015 at 16:32 | comment | added | Matthew | No, checking a HMAC merely shows that the data hasn't been tampered with between the time of encryption and the time of decryption. If you are worried about keys being stolen, the HMAC will be perfectly valid - the person who has a copy of the key can generate a valid HMAC in exactly the same way as the original owner. | |
| Nov 10, 2015 at 16:25 | comment | added | user91560 | you can provide authentication with symmetric cryptography check HMAC. Also it is client who needs to be authenticated, I believe keys on server can be assumed to be more safe | |
| Nov 10, 2015 at 16:18 | history | answered | Matthew | CC BY-SA 3.0 |