Questions tagged [asymmetric]
Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.
299
questions
0
votes
2
answers
36
views
Asymmetric crypto algorithm for encryption with hardware token
Our product stores voucher data in a database.
These voucher data can be retrieved with our app to display a voucher that can be used for payments.
Obviously, these voucher data are extremely ...
0
votes
1
answer
57
views
Write message that can be verified by any member of a group
I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by.
There may be tens of messages generated each ...
- 101
0
votes
1
answer
146
views
Consequences of stolen TLS private key
My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
- 103
0
votes
0
answers
49
views
Could a trusted CA pretend to be me and run a MITM? [duplicate]
Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
3
votes
2
answers
2k
views
Create encryption key from decryption key (password)?
Alice has a password that she would like to use for decryption. Alice isn't able to store any other information, but she has access to any program/mechanism you choose.
How can she create an ...
- 141
8
votes
6
answers
6k
views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice.
Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 549
0
votes
1
answer
46
views
Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
1
vote
1
answer
81
views
Is SRP/PAKE equivalent to an asymmetric crypto challenge?
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
- 181
1
vote
3
answers
113
views
Is it possible to generate a read-only key for a symmetrical encryption (AES)?
I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the ...
- 11
0
votes
1
answer
117
views
How to handle private keys in a messenger app with asymmetric encryption?
I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side.
I generate a private and public key on server side and encrypt the messages ...
3
votes
2
answers
379
views
Does jwt with asymmetric algorithm have a bad performance?
I'm using Envoy as the gateway of my micro-service backend.
Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key.
...
- 341
2
votes
1
answer
360
views
Asymmetric encryption in case of multiple parties
For the consumer of the API to send and receive, encrypt and decrypt into that same API, wouldn't the client consumer also have to have the same public and private key as the server that provides the ...
- 125
1
vote
2
answers
168
views
Using asymmetric encryption as authentication over HTTP?
I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I ...
2
votes
1
answer
418
views
Key management: Can I delete private key in asymmetric encryption?
If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?
For example with a JWT, or a file hash use for audit at a later date, ...
- 123
0
votes
2
answers
122
views
Asymmetric encryption and data sharing
I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user287213
2
votes
1
answer
135
views
How to use (py)NaCl/libsodium for key wrap, key encapsulation
We want to wrap / encapsulate
a symmetric key with an asymmetric keypair,
a symmetric key with a symmetric key,
a private key with a symmetric key.
In each case, we'd like to allow several keys to ...
- 21
1
vote
2
answers
138
views
How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand
Both hosts have just their public and private key pair (but they do not have the other party’s public key).
Bob should be authenticated
Assume that the two hosts share clocks that are synced, i.e ...
user285662
0
votes
1
answer
93
views
Will the public-key cryptosystem change in a post-quantum state?
I would like to preface this with the information that I am clearly not well versed in crypto, so my understand so far may not be accurate.
CISA recently published an advisory Preparing Critical ...
- 1,734
0
votes
0
answers
52
views
In asymmetric encryption, is there a meaningful difference between the public and the private key? [duplicate]
Is it possible to swap them, so that the public key is kept secret while the private key is public? Or do they actually function differently?
Thinking specifically about DSA though I'm interested if ...
- 1,259
0
votes
0
answers
70
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
1
vote
0
answers
25
views
Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]
My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
- 11
0
votes
0
answers
35
views
Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password
please verify or explain how to do this properly.
I'm letting a user create keys from the client through a secure server.
I ask the user for a password on the client, then send the hashed password to ...
- 103
0
votes
1
answer
43
views
Saving signed file on an encrypted drive using symmetric encryption
When using asymmetric encryption, signing and encryption are the same, but opposite, operations.
Say I have my drive encrypted with asymmetric encryption.
If I save a signed file to that drive, using ...
- 5
1
vote
1
answer
226
views
Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?
In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH.
What about when an entry node communicating ...
- 71
1
vote
1
answer
559
views
How are session keys transferred between a client and a server?
Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE.
However, I have heard that session keys are single-use, which mean a ...
- 71
1
vote
1
answer
101
views
Standard for public-key authentication (separate from channel encryption)
Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys.
Scenario/threat model
...
- 755
0
votes
1
answer
852
views
GPG4WIN Kleopatra does not require RSA secret key components to decrypt
I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted ...
- 53
0
votes
0
answers
118
views
decryption of message using private key [duplicate]
I don't why we can decrypt the message using our private key if it's encrypted using our public key.
If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
- 1
4
votes
1
answer
559
views
Asymmetric encryption of very small messages
I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and ...
- 143
0
votes
1
answer
116
views
What are the different combinations of public and private keys and what CIA do they provide?
I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
- 1
0
votes
1
answer
354
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
0
votes
1
answer
123
views
How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]
Using the cipher suite “TLS_AES_128_CCM_SHA256”
This example is referring to a self signed certificate
If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
- 1
0
votes
1
answer
83
views
Benefit of asymmetric encryption vs trivial alternatives in compromised software?
Background information:
I have a client application that communicates with a server through a web API.
The data being communicated is not personally sensitive (no passwords, credit card details, ...
- 143
0
votes
1
answer
141
views
Getting Smaller Output From Public Key Cryptography In PHP
I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
- 753
1
vote
1
answer
111
views
How can I improve the application administrator's encryption keys security inside database
I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak.
It was decided to use the following encryption chain:
User data is ...
1
vote
1
answer
267
views
How best to cryptographically sign scientific papers?
Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone.
Usually these aren't high-...
- 181
0
votes
2
answers
334
views
Using Private Key for encryption
I want to implement simple software protection mechanism. This is how it would look like:
My question is - is there any problem for me using the private key for encryption and public for decryption (...
- 119
0
votes
0
answers
99
views
asymmetric file system authentication
Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
- 158
0
votes
2
answers
201
views
Is it insecure to encrypt a message with a key thats almost the same as the message
I am using a syymetric token, a fernet from the python cryptography module. I am trying to make it such that a terminal logs into a website automatically.
I store the serial number and mac address of ...
- 125
0
votes
1
answer
195
views
Enlighten Me Please Regarding PGP Encryption [duplicate]
I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
- 103
0
votes
2
answers
495
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
- 175
1
vote
1
answer
131
views
How is the initial request made to the Access Server in Kerberos?
I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
- 283
0
votes
2
answers
258
views
Need some clarification regards end-to-end encryption process
Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
- 1
2
votes
2
answers
481
views
RSA encryption with plaintext+random data
I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. ...
- 700
4
votes
3
answers
309
views
How can you bind a public key to a certificate if the public key depends on the choice of algorithms?
Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
- 47
0
votes
0
answers
76
views
Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?
This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
- 1
0
votes
1
answer
144
views
Is creating asymmetric keys dynamically and storing in memory safe?
I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
- 125
1
vote
0
answers
150
views
Digital Signature uses private key for encryption, and public key for decryption? [duplicate]
Public key is for encryption, and private key is for decryption in PKIs.
And digital signature employs the PKIs.
How to use a private key for encryption, and using public key for decryption which ...
- 11
0
votes
1
answer
3k
views
Diffie–Hellman key exchange in TLS 1.3
I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
- 51
4
votes
1
answer
3k
views
What is the correct way to create a backup copy of a PGP key pair?
I am using GnuPG 2.2.20 to create my key pair.
I have successfully created a key pair, now I want to create a backup copy in case of HDD failure.
Following the instruction here, I have tried
gpg --...
- 517