Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
1
vote
1answer
85 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
0
votes
0answers
56 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
0
votes
0answers
20 views

In search of a pedagogically simple example of asymmetric encryption routine? [migrated]

(I am not a cryptography expert; I do write software) I am working with some youth (ages 11-13) and wanted to explore for an hour or so some basic cryptography. Doing symmetric ciphers is pretty ...
1
vote
2answers
69 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
7
votes
2answers
1k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
2
votes
0answers
28 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
0answers
85 views

How is a cryptographic key used as a password when using WiFi? [duplicate]

I have recently come from a post and the accepted answer described the password as a cryptographic key. I have an understanding of RSA, AES and uses of it such as digital signatures however I fail to ...
0
votes
0answers
18 views

In Asymmetric public/private key over a web connection, how does the client decrypt what the server sends? [duplicate]

When I go to a secure site and they have a good certificate, etc., and they encrypt a message to me, I do not understand how I am decrypting it. Where did I, the client, get the private key to ...
1
vote
3answers
87 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
0
votes
0answers
52 views

Asymmetric encryption for short strings and files

I need to encrypt some strings in a database, and contents of files, with an asymmetric key (probably RSA), but possibly symmetrically at some point. Many of these are a few dozen bytes, so overhead ...
0
votes
1answer
117 views

Is asymmetric encryption is safe on the Internet? Can't a hacker just pose as a valid user?

When I read the RSA asymmetric encryption: In the environment: Rules are: blue boy, red girl, and black men. blue boy and red girl all have their own public key (blue) and private key (red). In ...
0
votes
1answer
92 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
0
votes
0answers
56 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
0
votes
1answer
88 views

For encrypted chat app, how can I store sent messages so that they are encrypted but still can be viewed by the sender?

Actual implimentaton will be in android but this is more about general security than actual implimentaton details. I'm making an end-to-end encrypted chat app and I know that in order to send ...
3
votes
0answers
119 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
5
votes
1answer
776 views

Asymmetric or symmetric - which makes sense in this scenario?

I am creating a system in which there will be oe client and one server. The client is periodically (every 5 or 10 secs) going to send a small amount of data to the server (with UDP). I am able to ...
0
votes
1answer
99 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
1answer
169 views

OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?

I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
-1
votes
1answer
227 views

want to know best way to my case is to encrypt the UART communication channel? [closed]

I have device connected to scooter it’s 4- wire uart communication. My fear is some can read the ascii data and send the at commands and unlock my scooter and steal the scooter. I want to secure the ...
0
votes
1answer
144 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
1
vote
1answer
122 views

How to combine symmetric and asymmetric encryption to encrypt large files?

I understand that it is possible to combine symmetric and asymmetric encryption in a way that makes use of the performance of symmetric encryption, and also getting the benefits of being able to ...
0
votes
2answers
86 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
109 views

Is this strategy end 2 end encryption and secure?

I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please. The workflow is as follows: A customer indicates they want to ...
1
vote
2answers
78 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
1answer
160 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
-2
votes
1answer
84 views

Which scheme provides the shortest public key, while being secure? [closed]

I was wondering about whether there exists a scheme that would have the following properties: Be asymmetric (Encrypt with public key, decrypt with private key) Be secure by today's standards (as hard ...
2
votes
3answers
192 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
2
votes
1answer
94 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
0
votes
1answer
605 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
1
vote
1answer
162 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
1
vote
0answers
87 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
0
votes
2answers
135 views

Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt?

Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256. A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv ...
2
votes
3answers
659 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
1
vote
1answer
69 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
2answers
55 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
3
votes
4answers
150 views

Asymmetric Encryption

I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...
0
votes
2answers
52 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
1
vote
0answers
25 views

What measures are used to protect private keys on credit card processing devices?

For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
0
votes
1answer
136 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
0
votes
1answer
2k views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
0
votes
0answers
38 views

Public encryption scheme where decryption key become valid on certain timestamp?

I am looking for a solution in asymmetric cryptography where the decryption will only be possible after a certain condition i.e. after certain time passed or on certain date. The key and cipher should ...
1
vote
0answers
288 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
3
votes
1answer
131 views

Publishing a private key as a way to revoke it?

Academically, I've been thinking of a system where every user has identities tied to private/public key pairs. A Web Of Trust style of verifying other users builds trust in who is who. If you want to ...
0
votes
1answer
141 views

How Symmetric key Occurs in SSH? [duplicate]

How Symmetric Key occurs in SSH process? As I think that the Asymmetric key used for the only Authentication but my main problem is "How Server generates the Symmetric Key which will use to do secure ...
0
votes
2answers
2k views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
0
votes
0answers
75 views

Elgamal encryption algorithm

I have question about elgamal algorithm, Why NIST do not certified this algorithm, And every implementation of this algorithm in Python language have Vulnerability?
13
votes
1answer
3k views

Why is asymmetric encryption less efficient than symmetric encryption?

It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
2
votes
1answer
806 views

Collision-free cryptographic hashing?

I wish to hash something that outputs a collision-free hash, and to use that hash as an id in a database. Using conventional cryptographic hashing (fixed-length) means there is a chance of collision, ...
-1
votes
3answers
470 views

How are private keys distributed safely?

I am going through the RSA algorithm and I have a few questions. My understanding of RSA Algorithm: How does a receiver get his private keys P and Q? For a particular public key, if every receiver ...
2
votes
1answer
208 views

Why are private keys alpha-numeric?

In asymmetric encryption, if a private key is in-fact the multiplication of 2 prime numbers, then how come it is alphanumeric?