Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
2
votes
1answer
232 views

Asymmetric encryption of very small messages

I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and ...
0
votes
1answer
45 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
0
votes
1answer
53 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
1
vote
1answer
102 views

How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]

Using the cipher suite “TLS_AES_128_CCM_SHA256” This example is referring to a self signed certificate If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
0
votes
1answer
55 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
3
votes
0answers
112 views

Security vs. User Experience – can this Process still be considered to provide proper End-to-End-Encryption?

I am banging my head about this for a while now and would appreciate opinions/different views. tl;dr There is a system that aims to provide full end-to-end encryption for information (text messages, ...
0
votes
1answer
57 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
1
vote
1answer
84 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
0
votes
1answer
178 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
-1
votes
2answers
182 views

Using Private Key for encryption

I want to implement simple software protection mechanism. This is how it would look like: My question is - is there any problem for me using the private key for encryption and public for decryption (...
0
votes
0answers
81 views

asymmetric file system authentication

Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
0
votes
2answers
136 views

Is it insecure to encrypt a message with a key thats almost the same as the message

I am using a syymetric token, a fernet from the python cryptography module. I am trying to make it such that a terminal logs into a website automatically. I store the serial number and mac address of ...
0
votes
1answer
104 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
0
votes
2answers
152 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
1
vote
1answer
101 views

How is the initial request made to the Access Server in Kerberos?

I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
0
votes
2answers
124 views

Need some clarification regards end-to-end encryption process

Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
2
votes
2answers
145 views

RSA encryption with plaintext+random data

I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. ...
4
votes
3answers
232 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
0
votes
0answers
60 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
0
votes
1answer
86 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
145 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
91 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
1
vote
1answer
736 views

Diffie–Hellman key exchange in TLS 1.3

I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
2
votes
1answer
748 views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
1
vote
2answers
132 views

Can the user get the private key from the encrypted and the decrypted data?

Can the user get the private key from the encrypted and the plaintext data or does it make it easier for an attacker?
1
vote
1answer
150 views

Can I change expiration date of a gpg key I've already sent to a key server?

ArchLinux wiki page on GnuPG reads Once a key has been submitted to a keyserver, it cannot be deleted from the server. Does that mean that also the expiration date with which I published the key via ...
1
vote
1answer
155 views

Difference between Symmetric and Asymmetric encryption

I was watching this short video and apparently every time users open an HTTPS connection, a handshake between client & server happens. They interchange the public keys, keeping the private keys. ...
0
votes
0answers
89 views

Asymmetric Encrypted Container

I'd like to set up a remote backup for my PC. I want to have it run at scheduled times, encrypting the data locally and then transmitting it to the server. I'd like to use something popular and open ...
1
vote
1answer
107 views

What are the benefits of using WebAuthn?

The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following: Server sends a challenge (16 ...
0
votes
2answers
80 views

Changing private key in asymmetric encryption and recovering data

Let's say I want to make an encrypted message app (just an example). So, I will need a user1 with a password1, private key1 (that will be encrypted with the password1), public key1 (that will depend ...
0
votes
0answers
156 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
3
votes
0answers
142 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
0
votes
1answer
86 views

What are useful use cases for employing asymmetric cryptography in a database?

I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
-2
votes
1answer
149 views

A proposal to prevent man in the middle attacks

Let us assume that there is a man in the middle who can read (not modify) all the data that's being transferred between a client and the server. We want the client to be able to log in without ...
0
votes
0answers
113 views

Is there a standard approach for serializing an RSA encrypted AES key alongside the AES payload itself?

Diffie-Hellman won't really work here, since only one side has a public key, one side has the private. It must be this way to prevent decryption when the data is at-rest on one of the sides before ...
3
votes
2answers
623 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
0
votes
2answers
125 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
89 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
1
vote
1answer
78 views

Storing private keys for updates to remote device

I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me. Based on my understanding of ...
0
votes
0answers
143 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
0
votes
1answer
383 views

Store credit card data in google sheets - Asymetric Encryption

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
0
votes
2answers
73 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
2answers
469 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
1answer
309 views

Compare fingerprints of gpg --verify for files download with / without TOR

From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we ...
3
votes
1answer
179 views

how to associate a public key with a user of a website

I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he ...
1
vote
0answers
89 views

Is there a secure way to share a secret key to another entity without a use of PKI

My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
3
votes
1answer
637 views

"Digital" signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
11
votes
1answer
687 views

What gpg defaults can be improved, when performance is not an issue?

gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people. But, in a situation where speed ...
0
votes
1answer
372 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
1
vote
1answer
132 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...

1
2 3 4 5 6