Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
1
vote
1answer
66 views

How is the initial request made to the Access Server in Kerberos?

I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
0
votes
2answers
81 views

Need some clarification regards end-to-end encryption process

Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
2
votes
2answers
85 views

RSA encryption with plaintext+random data

I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. ...
4
votes
3answers
196 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
0
votes
0answers
29 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
0
votes
1answer
46 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
1
vote
0answers
144 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
60 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
1
vote
1answer
213 views

Diffie–Hellman key exchange in TLS 1.3

I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
1
vote
1answer
218 views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
1
vote
2answers
91 views

Can the user get the private key from the encrypted and the decrypted data?

Can the user get the private key from the encrypted and the plaintext data or does it make it easier for an attacker?
0
votes
0answers
56 views

What encryption protocol is Kleopatra using to protect the private key?

What encryption protocol is Kleopatra using to protect the private key? I checked PGP RFC document and found out different protocols can be used, it's up to the software developer. Has anyone be able ...
1
vote
0answers
80 views

Can I change expiration date of a gpg key I've already sent to a key server?

ArchLinux wiki page on GnuPG reads Once a key has been submitted to a keyserver, it cannot be deleted from the server. Does that mean that also the expiration date with which I published the key via ...
1
vote
1answer
96 views

Difference between Symmetric and Asymmetric encryption

I was watching this short video and apparently every time users open an HTTPS connection, a handshake between client & server happens. They interchange the public keys, keeping the private keys. ...
0
votes
0answers
45 views

Asymmetric Encrypted Container

I'd like to set up a remote backup for my PC. I want to have it run at scheduled times, encrypting the data locally and then transmitting it to the server. I'd like to use something popular and open ...
0
votes
0answers
44 views

Deciding the kind of key required for implementation of monitoring software

Different companies seek permission to start and run, from our organization. I am approval or permission-giving authority. I am having an inspector who goes to different places and visits companies ...
0
votes
1answer
61 views

What are the benefits of using WebAuthn?

The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following: Server sends a challenge (16 ...
0
votes
2answers
51 views

Changing private key in asymmetric encryption and recovering data

Let's say I want to make an encrypted message app (just an example). So, I will need a user1 with a password1, private key1 (that will be encrypted with the password1), public key1 (that will depend ...
0
votes
0answers
86 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
3
votes
0answers
115 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
0
votes
1answer
55 views

What are useful use cases for employing asymmetric cryptography in a database?

I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
-1
votes
1answer
95 views

A proposal to prevent man in the middle attacks

Let us assume that there is a man in the middle who can read (not modify) all the data that's being transferred between a client and the server. We want the client to be able to log in without ...
0
votes
0answers
64 views

Is there a standard approach for serializing an RSA encrypted AES key alongside the AES payload itself?

Diffie-Hellman won't really work here, since only one side has a public key, one side has the private. It must be this way to prevent decryption when the data is at-rest on one of the sides before ...
3
votes
2answers
345 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
0
votes
2answers
84 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
56 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
1
vote
1answer
39 views

Storing private keys for updates to remote device

I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me. Based on my understanding of ...
0
votes
0answers
80 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
0
votes
1answer
249 views

Store credit card data in google sheets - Asymetric Encryption

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
0
votes
2answers
40 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
2answers
217 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
1answer
193 views

Compare fingerprints of gpg --verify for files download with / without TOR

From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we ...
3
votes
1answer
126 views

how to associate a public key with a user of a website

I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he ...
1
vote
0answers
58 views

Is there a secure way to share a secret key to another entity without a use of PKI

My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
3
votes
1answer
547 views

“Digital” signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
11
votes
1answer
555 views

What gpg defaults can be improved, when performance is not an issue?

gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people. But, in a situation where speed ...
0
votes
1answer
279 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
1
vote
1answer
103 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
0
votes
0answers
184 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
1
vote
2answers
380 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
8
votes
2answers
3k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
2
votes
0answers
50 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
1
vote
3answers
583 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
0
votes
1answer
131 views

Is asymmetric encryption is safe on the Internet? Can't a hacker just pose as a valid user?

When I read the RSA asymmetric encryption: In the environment: Rules are: blue boy, red girl, and black men. blue boy and red girl all have their own public key (blue) and private key (red). In ...
0
votes
1answer
775 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
1
vote
0answers
61 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
0
votes
1answer
208 views

For encrypted chat app, how can I store sent messages so that they are encrypted but still can be viewed by the sender?

Actual implimentaton will be in android but this is more about general security than actual implimentaton details. I'm making an end-to-end encrypted chat app and I know that in order to send ...
3
votes
0answers
250 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
5
votes
1answer
786 views

Asymmetric or symmetric - which makes sense in this scenario?

I am creating a system in which there will be oe client and one server. The client is periodically (every 5 or 10 secs) going to send a small amount of data to the server (with UDP). I am able to ...
3
votes
1answer
259 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...

1
2 3 4 5 6