Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

2
votes
1answer
61 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
0
votes
1answer
131 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
1
vote
1answer
62 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
1
vote
0answers
42 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
0
votes
2answers
86 views

Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt?

Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256. A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv ...
1
vote
3answers
76 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
0
votes
1answer
28 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
2answers
48 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
3
votes
4answers
129 views

Asymmetric Encryption

I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...
0
votes
2answers
41 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
1
vote
0answers
23 views

What measures are used to protect private keys on credit card processing devices?

For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
-1
votes
1answer
65 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
0
votes
1answer
150 views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
0
votes
0answers
36 views

Public encryption scheme where decryption key become valid on certain timestamp?

I am looking for a solution in asymmetric cryptography where the decryption will only be possible after a certain condition i.e. after certain time passed or on certain date. The key and cipher should ...
1
vote
0answers
124 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
3
votes
1answer
107 views

Publishing a private key as a way to revoke it?

Academically, I've been thinking of a system where every user has identities tied to private/public key pairs. A Web Of Trust style of verifying other users builds trust in who is who. If you want to ...
0
votes
1answer
73 views

How Symmetric key Occurs in SSH? [duplicate]

How Symmetric Key occurs in SSH process? As I think that the Asymmetric key used for the only Authentication but my main problem is "How Server generates the Symmetric Key which will use to do secure ...
0
votes
2answers
359 views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
0
votes
0answers
52 views

Elgamal encryption algorithm

I have question about elgamal algorithm, Why NIST do not certified this algorithm, And every implementation of this algorithm in Python language have Vulnerability?
13
votes
1answer
1k views

Why is asymmetric encryption less efficient than symmetric encryption?

It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
2
votes
1answer
312 views

Collision-free cryptographic hashing?

I wish to hash something that outputs a collision-free hash, and to use that hash as an id in a database. Using conventional cryptographic hashing (fixed-length) means there is a chance of collision, ...
-1
votes
3answers
188 views

How are private keys distributed safely?

I am going through the RSA algorithm and I have a few questions. My understanding of RSA Algorithm: How does a receiver get his private keys P and Q? For a particular public key, if every receiver ...
2
votes
1answer
153 views

Why are private keys alpha-numeric?

In asymmetric encryption, if a private key is in-fact the multiplication of 2 prime numbers, then how come it is alphanumeric?
1
vote
1answer
109 views

Encrypt a body instead of Signing it (with JWT for example)

What would be the issue if I encrypt the "claims/body/data" and I send it to the user, then when the user sends me this encrypted token, I decrypt it I trust it, and operate on the data in it (If it's ...
-5
votes
1answer
345 views

Does WhatsApp use asymmetric encryption?

I know that WhatsApp uses some kind of encryption to encrypt messages, but is it asymmetric encryption? If not what kind of encryption does it use?
2
votes
2answers
311 views

Does asymmetric encryption guarantee data integrity?

I have some unusual size constraints for my data which may be relevant to the prescribed solution. The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by ...
4
votes
2answers
426 views

JWT or public-private keys for service to service API calls

I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else. I ...
-2
votes
2answers
106 views

Why can't the RSA algorithm be used for symmetric key infrastructures?

If RSA is an encryption algorithm used to create an asymmetric key pair and digital signature, why can't it also be used to create a symmetric key? Even if RSA is used to create public keys, why can'...
1
vote
1answer
218 views

2048 bit SSH RSA public key vs AWS KMS-encrypted text in source control

I'm trying to work out how acceptable it is to commit KMS-encrypted API keys to source control. It is (I believe) often deemed acceptable to commit public keys to source control. So, to try to compare ...
3
votes
2answers
123 views

Symmetric encryption for data protection

My team is working on a solution to store sensitive information on a remote storage solution. I am proposing that we use symmetric encryption of the data where there is a unique key per document. ...
0
votes
3answers
116 views

How does the Certificate Authority work [duplicate]

I'm learning how the Certificate Authority work and have a question. As my understanding, the Certificate Authority can guarantee that the client get the true public-key: Saying that I'm a server and ...
0
votes
3answers
122 views

Can a malicious SSH server successfully *pretend* to know a client's public key?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and ...
0
votes
0answers
47 views

Why can't hacker decrypt by reverting encryption done by public key given by server? [duplicate]

Okay. So my doubt is very basic and I tried to clear it with other questions asked here. But still got nothing which can help me understand, so here it is. In asymmetric encryption between A and B, A ...
0
votes
0answers
37 views

How are Transactions verified before signed by a HSM?

Given a setup where a server, that is running some sort of a trading bot, is connected to a HSM. That HSM is containing the private key to asymetrically sign all the transactions issued by the bot/...
1
vote
1answer
78 views

Can JavaScript encryption's problems be mitigated?

Earlier this year, I was asked to evaluate using JavaScript to encrypt sensitive information in the user's browser before sending it to our server. While my first response was "ask an expert", my boss ...
1
vote
0answers
98 views

Are there any good instant messaging applications with a good end-to-end encryption to its web application? [closed]

Whether an app like Telegram is secure or not has already been answered and it has recently been confirmed that it is not. Apps like Signal and Cryptocat have been recommended instead. But do these ...
0
votes
1answer
56 views

Question on DH key exchange

The server is configured to support the cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA and validate the client's certificate. My understanding is that the server uses DH for key exchange which does ...
0
votes
1answer
59 views

How can I sign a file with an alternate key

I have two keys in my keyring: jason@host $ gpg --list-keys /home/jason/.gnupg/pubring.gpg ------------------------------ pub 1024R/B051EDBF 2017-11-27 uid realname <someone@...
1
vote
0answers
114 views

ROCA attack on TPM - public key extraction

I was reading about the ROCA attack, and how a lot of software is vulnerable. Apparently Bitlocker from Microsoft is also vulnerable, because it protects its keys with SRK of (ROCA vulnerable) TPM. ...
1
vote
3answers
1k views

Storing User's Private Keys in DB

I have the need to store private keys for multiple users, so that my server application can sign files on their behalf. I want to store these keys securely, but couldn't find much information on this ...
0
votes
1answer
43 views

How do we exchange public key securely in a DV SSL connection? [closed]

Let's said we're running asymmetric encryption on a server with DV SSL encryption. With this condition set, how do we send the users' public key and private key generate in server to client in order ...
-2
votes
2answers
230 views

Is private key encryption to verify identity a weakness?

I'm trying to learn about cryptography and have discovered that you can use asymmetric key encryption to verify your identity by encrypting something with your private key, but isn't that a security ...
6
votes
4answers
2k views

Can data be decrypted with the public key if encrypted with the private key? [duplicate]

I am trying to understand the principles of asymmetric encryption, and have read the following in a book: One key is completely public and can be read and used by everyone. The other part is ...
2
votes
1answer
81 views

Share a public key from an app to verify authenticity of data submitted

I'm quite new to information security topics and am looking for guidance to implement secure transmission of statistical data from an app to a server. In addition, I don't want any knowledge about the ...
0
votes
2answers
816 views

Log in without password using SSH, knowing authorized_keys?

During a pentest, I was able to get the contents of authorized_keys file which has a single client's entry. So, can I generate a private key using the public key from this file, and login to the ...
0
votes
1answer
151 views

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
2
votes
3answers
1k views

How does the digital signature process work?

I'm trying to understand the process of digital signature verification, however I don't quite get the explanation in my book. If A wants to send a message to B with a digital signature, the process ...
1
vote
2answers
565 views

Why don't digital signatures reveal the senders Private Key

As I understand it, Digital Signatures involve the 'signage' of a message using the senders Private Key, and its validation by the recipient using the sender's mathematically-related Public Key. ...
1
vote
0answers
447 views

Which encryption algorithm is used in php openssl_public_encrypt [closed]

I am looking for exact algorithm that is used in PHP's openssl_public_encrypt function, as I need to encrypt some data in android app with that, and I couldnt find android equivalent of PHP's ...
1
vote
1answer
114 views

How to encrypt data asymmetrically to be decrypt my multiple users

I'm designing a chat-like application. Every message sent must be encrypted. Multiple users must be able to decrypt it. In the early stage, a chat will contains only two chatters. This way I can ...