Skip to main content

Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
2 votes
0 answers
20 views

Forgable and unconfidential short-term signature [migrated]

I have a very unusual set of requirements for a cryptographic system and hope someone can help me. My requirements are: Asymmetric: A private key is needed to sign, and a public key is used for ...
pils_user_'s user avatar
1 vote
1 answer
120 views

Why does the Signal Protocol use a symmetric key for encryption- when asymmetric keys are more secure? [duplicate]

The Signal Protocol, as many of you would know, is used by many applications such as WhatsApp and Signal. These corporations, I can vouch for, would definitely use the most secure protocol they could- ...
security_paranoid's user avatar
0 votes
2 answers
55 views

Infer information of private key from public key / CSR

is it possible to infer information like: algorithm, key length, mode etc. of the private key from the public key or CSR?
Hans's user avatar
  • 1
0 votes
1 answer
73 views

relation passphrase and password-based key derivation

I am not totally sure how the following concepts are related, could someone please explain? password-based key derivation passphrase that can be passed to crypto.generateKeyPairSync (in Node.js) ...
yolooow's user avatar
  • 25
0 votes
1 answer
105 views

Encryption without a classic exchange scenario

I am working on a project where I need to securely encrypt and decrypt files on a product without the ability for direct communication or key derivation after the product is sold. The challenge is ...
mrx's user avatar
  • 1
0 votes
0 answers
86 views

How much data is signed during TLS handshakes?

My general understanding is that in server-only TLS, the connection establishment proceeds like so: Client opens a TCP connection to the server, passing SNI and other data such as supported ciphers/...
Naftuli Kay's user avatar
  • 6,813
0 votes
2 answers
117 views

Asymmetric crypto algorithm for encryption with hardware token

Our product stores voucher data in a database. These voucher data can be retrieved with our app to display a voucher that can be used for payments. Obviously, these voucher data are extremely ...
Erik Moldtmann's user avatar
1 vote
1 answer
125 views

Write message that can be verified by any member of a group

I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by. There may be tens of messages generated each ...
gilbertbw's user avatar
  • 111
0 votes
1 answer
592 views

Consequences of stolen TLS private key

My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
Tripola's user avatar
  • 103
0 votes
0 answers
108 views

Could a trusted CA pretend to be me and run a MITM? [duplicate]

Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
fruitless fruit juice's user avatar
3 votes
2 answers
2k views

Create encryption key from decryption key (password)?

Alice has a password that she would like to use for decryption. Alice isn't able to store any other information, but she has access to any program/mechanism you choose. How can she create an ...
Entity Black's user avatar
8 votes
6 answers
6k views

Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?

Lets say Bob wishes to communicate with Alice. Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
David Davidson's user avatar
0 votes
1 answer
110 views

Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files

For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
user291052's user avatar
1 vote
1 answer
182 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
Dolda2000's user avatar
  • 201
1 vote
3 answers
232 views

Is it possible to generate a read-only key for a symmetrical encryption (AES)?

I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the ...
Koray Kaya's user avatar
0 votes
1 answer
314 views

How to handle private keys in a messenger app with asymmetric encryption?

I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side. I generate a private and public key on server side and encrypt the messages ...
Mateen Bagheri's user avatar
4 votes
2 answers
1k views

Does jwt with asymmetric algorithm have a bad performance?

I'm using Envoy as the gateway of my micro-service backend. Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key. ...
Yves's user avatar
  • 361
2 votes
1 answer
431 views

Asymmetric encryption in case of multiple parties

For the consumer of the API to send and receive, encrypt and decrypt into that same API, wouldn't the client consumer also have to have the same public and private key as the server that provides the ...
Berlin Brown's user avatar
1 vote
2 answers
338 views

Using asymmetric encryption as authentication over HTTP?

I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe. But I ...
David Fischer's user avatar
2 votes
1 answer
656 views

Key management: Can I delete private key in asymmetric encryption?

If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data? For example with a JWT, or a file hash use for audit at a later date, ...
vbuser2004's user avatar
0 votes
2 answers
389 views

Asymmetric encryption and data sharing

I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user avatar
2 votes
1 answer
283 views

How to use (py)NaCl/libsodium for key wrap, key encapsulation

We want to wrap / encapsulate a symmetric key with an asymmetric keypair, a symmetric key with a symmetric key, a private key with a symmetric key. In each case, we'd like to allow several keys to ...
BGWPVqRM3xIg's user avatar
1 vote
2 answers
207 views

How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand

Both hosts have just their public and private key pair (but they do not have the other party’s public key). Bob should be authenticated Assume that the two hosts share clocks that are synced, i.e ...
user avatar
1 vote
1 answer
180 views

Will the public-key cryptosystem change in a post-quantum state?

I would like to preface this with the information that I am clearly not well versed in crypto, so my understand so far may not be accurate. CISA recently published an advisory Preparing Critical ...
cutrightjm's user avatar
  • 1,753
1 vote
0 answers
54 views

In asymmetric encryption, is there a meaningful difference between the public and the private key? [duplicate]

Is it possible to swap them, so that the public key is kept secret while the private key is public? Or do they actually function differently? Thinking specifically about DSA though I'm interested if ...
brentonstrine's user avatar
0 votes
0 answers
144 views

Create "bare" pgp private key / Make private key without being able to generate the public key from it

How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
Myzel394's user avatar
  • 142
1 vote
0 answers
27 views

Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]

My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
Abhisek Dash's user avatar
0 votes
0 answers
76 views

Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password

please verify or explain how to do this properly. I'm letting a user create keys from the client through a secure server. I ask the user for a password on the client, then send the hashed password to ...
irth's user avatar
  • 103
0 votes
1 answer
81 views

Saving signed file on an encrypted drive using symmetric encryption

When using asymmetric encryption, signing and encryption are the same, but opposite, operations. Say I have my drive encrypted with asymmetric encryption. If I save a signed file to that drive, using ...
Jonathan's user avatar
1 vote
1 answer
353 views

Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?

In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH. What about when an entry node communicating ...
Gaai Chia's user avatar
1 vote
1 answer
970 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
Gaai Chia's user avatar
1 vote
1 answer
142 views

Standard for public-key authentication (separate from channel encryption)

Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys. Scenario/threat model ...
Ben Voigt's user avatar
  • 829
0 votes
1 answer
1k views

GPG4WIN Kleopatra does not require RSA secret key components to decrypt

I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted ...
Dominic Jung's user avatar
0 votes
0 answers
154 views

decryption of message using private key [duplicate]

I don't why we can decrypt the message using our private key if it's encrypted using our public key. If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
navid's user avatar
  • 1
4 votes
1 answer
760 views

Asymmetric encryption of very small messages

I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and ...
superstator's user avatar
0 votes
1 answer
171 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
User's user avatar
  • 1
0 votes
1 answer
682 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
espenhogbakk's user avatar
0 votes
1 answer
183 views

How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]

Using the cipher suite “TLS_AES_128_CCM_SHA256” This example is referring to a self signed certificate If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
Luke's user avatar
  • 1
0 votes
1 answer
130 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
Tyson's user avatar
  • 143
0 votes
1 answer
212 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
azoundria's user avatar
  • 763
1 vote
1 answer
146 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
Владимир Лопаткин's user avatar
1 vote
1 answer
351 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
0xDBFB7's user avatar
  • 181
0 votes
2 answers
487 views

Using Private Key for encryption

I want to implement simple software protection mechanism. This is how it would look like: My question is - is there any problem for me using the private key for encryption and public for decryption (...
Bojan Vukasovic's user avatar
0 votes
0 answers
127 views

asymmetric file system authentication

Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
beroal's user avatar
  • 158
0 votes
2 answers
267 views

Is it insecure to encrypt a message with a key thats almost the same as the message

I am using a syymetric token, a fernet from the python cryptography module. I am trying to make it such that a terminal logs into a website automatically. I store the serial number and mac address of ...
run_the_race's user avatar
0 votes
1 answer
247 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
Gerowen's user avatar
  • 103
1 vote
2 answers
735 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
Fax's user avatar
  • 185
1 vote
1 answer
180 views

How is the initial request made to the Access Server in Kerberos?

I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
northerner's user avatar
0 votes
2 answers
558 views

Need some clarification regards end-to-end encryption process

Let's say I want to make a messaging(just an example, take it as any data) web(react + node) application(more like an email rather than chat) with end-to-end encryption. So at some point, I will want ...
sembaas's user avatar
2 votes
2 answers
680 views

RSA encryption with plaintext+random data

I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. ...
b4da's user avatar
  • 710

1
2 3 4 5
7