0

I start by saying that I'm pretty new to encryption and I'm pretty bad at finding weakness in everything.

Said so, i'd like to talk about an huge doubt I'd like to clarify before I end up doing something wrong in pratice: one thing I learnt while studying symmetric key encryption methods such as aes is that salts are god. You should salt, salt and salt. And I get that it's really useful to block rainbow dictionary attacks and that's good. However, from what I got, all the examples were talking about cases where you're encrypting an user's password, which are usually known words or similar.

Let's suppose now an advanced scenario: I have an hybrid communication system using a RSA (asymmetric) and aes (symmetric) hybrid communication system between clients and a server where:

-the server owns a RSA private key, the clients owns the public part

when a client wants to establish a connection, he does:

1-generate a random symmetric key

2-encrypt it with the public RSA key

3-send it to the server

4-the server reads the ciphred key with the private key

5-now both systems has a symmetric key which will of course be monouse, which had never been transmitted in plain, and can communicate with the speed of aes

So the question is: in a scenario like that, is that really worthy salt the aes symmetric key before sending it to the server in point 3? Because first it's random, second it's monouse, 3rd as far as I know there is no way an hacker could do much without knowing the private key. And anyway the final password being sent is something which will be anyway a random set of characters, just as the unsalted key.

Or is there a scenario where it could be useful?

  • there's no need for a salt in your scenario. – dandavis Aug 28 '16 at 22:19
  • Hashing != Encrypting. Salting is for the former – GnP Aug 29 '16 at 0:23
1

You only need to hash and salt passwords that you store on a server for user authentication. In your case, you have a random key that will only be used for a connection's lifetime, so a salt would be useless.

Also keep in mind that your protocol doesn't provide authentication and is likely vulnerable to two dozens catastrophic attacks. We already have TLS for establishing a secure connection : use that if you want serious security (and don't make your own implementation : these require as much experience as the protocol itself).

  • Hi and tanks for answering. Unfortunately in my case I can't use TLS (unity3d-mysql server connections through PHP posts), so I'm struck with authenticating via posta etc (but everything is ciphred). Anyway I'm interestes in such "dozen of attacks": could you tell me some of them or give me an article about them just for personal culture? – Asduffo Aug 29 '16 at 20:54
  • Just look at all the attacks that have been discovered against TLS, which was made by people who know what they were doing. I found a RFC listing all the attacks known as of Feb. 2015, and I think new ones have been discovered until now : tools.ietf.org/html/rfc7457 . The Wikipedia page also lists the security concerns for all versions of SSL/TLS : en.wikipedia.org/wiki/Transport_Layer_Security#Security . If these people couldn't avoid making a protocol vulnerable to so much attacks, you alone certainly can't either. Maybe you could use a tunnel for your traffic ? – Elzo Aug 30 '16 at 10:01
  • No there are only sessions (which I don't think they are compatible with php but only with other game instances and if they are they are a unsuited for it) and posts available. The rest is handled by unity itself. But as I discussed in a paper in high school there is a limit between efforts and how worth they are. And I'm talking about a mobile game. So I can just use AES and RSA for users login/data transmission and I'm already doing too much XD But thanks again for your help I really appreciated it – Asduffo Aug 31 '16 at 13:13
  • [Double post] actually now that I look better I could use c# SslProtocols ans SslStream classes to communicate and and something such as cURL for php. – Asduffo Aug 31 '16 at 14:35
  • If you can't make a proper security, you shouldn't try to make one : it would just waste resources and give a false sense of security. – Elzo Aug 31 '16 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.