Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Public and Private Key as variables C# using Bouncy Castle [migrated]

I'm writing a function where this function is receiving my public key as variable, and the value for this variable is the actually public key. Example: string publicKey = "...
user avatar
0 votes
0 answers
27 views

Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password

please verify or explain how to do this properly. I'm letting a user create keys from the client through a secure server. I ask the user for a password on the client, then send the hashed password to ...
user avatar
  • 103
0 votes
1 answer
35 views

Saving signed file on an encrypted drive using symmetric encryption

When using asymmetric encryption, signing and encryption are the same, but opposite, operations. Say I have my drive encrypted with asymmetric encryption. If I save a signed file to that drive, using ...
user avatar
1 vote
1 answer
74 views

Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?

In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH. What about when an entry node communicating ...
user avatar
1 vote
1 answer
49 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
user avatar
1 vote
1 answer
74 views

Standard for public-key authentication (separate from channel encryption)

Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys. Scenario/threat model ...
user avatar
  • 760
0 votes
1 answer
240 views

GPG4WIN Kleopatra does not require RSA secret key components to decrypt

I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted ...
user avatar
0 votes
0 answers
43 views

decryption of message using private key [duplicate]

I don't why we can decrypt the message using our private key if it's encrypted using our public key. If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
user avatar
  • 1
4 votes
1 answer
424 views

Asymmetric encryption of very small messages

I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and ...
user avatar
0 votes
1 answer
67 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
user avatar
  • 1
0 votes
1 answer
70 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
user avatar
0 votes
1 answer
112 views

How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]

Using the cipher suite “TLS_AES_128_CCM_SHA256” This example is referring to a self signed certificate If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
user avatar
  • 1
0 votes
1 answer
67 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
user avatar
  • 143
3 votes
0 answers
122 views

Security vs. User Experience – can this Process still be considered to provide proper End-to-End-Encryption?

I am banging my head about this for a while now and would appreciate opinions/different views. tl;dr There is a system that aims to provide full end-to-end encryption for information (text messages, ...
user avatar
  • 233
0 votes
1 answer
69 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
user avatar
  • 743
1 vote
1 answer
94 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
user avatar
0 votes
1 answer
211 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
user avatar
  • 171
-1 votes
2 answers
220 views

Using Private Key for encryption

I want to implement simple software protection mechanism. This is how it would look like: My question is - is there any problem for me using the private key for encryption and public for decryption (...
user avatar
0 votes
0 answers
95 views

asymmetric file system authentication

Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
user avatar
  • 139
0 votes
2 answers
159 views

Is it insecure to encrypt a message with a key thats almost the same as the message

I am using a syymetric token, a fernet from the python cryptography module. I am trying to make it such that a terminal logs into a website automatically. I store the serial number and mac address of ...
user avatar
0 votes
1 answer
122 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
user avatar
  • 103
0 votes
2 answers
202 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
user avatar
  • 175
1 vote
1 answer
114 views

How is the initial request made to the Access Server in Kerberos?

I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
user avatar
0 votes
2 answers
151 views

Need some clarification regards end-to-end encryption process

Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
user avatar
2 votes
2 answers
209 views

RSA encryption with plaintext+random data

I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. ...
user avatar
  • 680
4 votes
3 answers
241 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
user avatar
  • 47
0 votes
0 answers
69 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
user avatar
0 votes
1 answer
102 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
user avatar
  • 125
1 vote
0 answers
149 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
user avatar
  • 11
0 votes
1 answer
1k views

Diffie–Hellman key exchange in TLS 1.3

I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
user avatar
  • 41
3 votes
1 answer
1k views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
user avatar
1 vote
2 answers
154 views

Can the user get the private key from the encrypted and the decrypted data?

Can the user get the private key from the encrypted and the plaintext data or does it make it easier for an attacker?
user avatar
1 vote
1 answer
243 views

Can I change expiration date of a gpg key I've already sent to a key server?

ArchLinux wiki page on GnuPG reads Once a key has been submitted to a keyserver, it cannot be deleted from the server. Does that mean that also the expiration date with which I published the key via ...
user avatar
  • 153
1 vote
1 answer
237 views

Difference between Symmetric and Asymmetric encryption

I was watching this short video and apparently every time users open an HTTPS connection, a handshake between client & server happens. They interchange the public keys, keeping the private keys. ...
user avatar
  • 137
0 votes
0 answers
101 views

Asymmetric Encrypted Container

I'd like to set up a remote backup for my PC. I want to have it run at scheduled times, encrypting the data locally and then transmitting it to the server. I'd like to use something popular and open ...
user avatar
  • 101
1 vote
1 answer
133 views

What are the benefits of using WebAuthn?

The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following: Server sends a challenge (16 ...
user avatar
  • 133
0 votes
2 answers
95 views

Changing private key in asymmetric encryption and recovering data

Let's say I want to make an encrypted message app (just an example). So, I will need a user1 with a password1, private key1 (that will be encrypted with the password1), public key1 (that will depend ...
user avatar
0 votes
0 answers
216 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
user avatar
3 votes
0 answers
154 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
user avatar
  • 31
0 votes
1 answer
97 views

What are useful use cases for employing asymmetric cryptography in a database?

I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
user avatar
-2 votes
1 answer
172 views

A proposal to prevent man in the middle attacks

Let us assume that there is a man in the middle who can read (not modify) all the data that's being transferred between a client and the server. We want the client to be able to log in without ...
user avatar
0 votes
0 answers
134 views

Is there a standard approach for serializing an RSA encrypted AES key alongside the AES payload itself?

Diffie-Hellman won't really work here, since only one side has a public key, one side has the private. It must be this way to prevent decryption when the data is at-rest on one of the sides before ...
user avatar
  • 101
3 votes
2 answers
902 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
user avatar
  • 189
0 votes
2 answers
137 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
user avatar
  • 189
0 votes
2 answers
108 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
user avatar
  • 189
1 vote
1 answer
94 views

Storing private keys for updates to remote device

I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me. Based on my understanding of ...
user avatar
  • 111
0 votes
0 answers
171 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
user avatar
0 votes
1 answer
488 views

Store credit card data in google sheets - Asymetric Encryption

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
user avatar
0 votes
2 answers
84 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
user avatar
0 votes
2 answers
595 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
user avatar

1
2 3 4 5 6