Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Is there a standard approach for serializing an RSA encrypted AES key alongside the AES payload itself?

Diffie-Hellman won't really work here, since only one side has a public key, one side has the private. It must be this way to prevent decryption when the data is at-rest on one of the sides before ...
3
votes
2answers
227 views

Does the CA create the public key or is it created by the requesting server and sent to the CA?

This link says that the requesting server creates the public-private key pair and sends the public key to the CA inside the CSR. However, DigiCert says: The CSR is submitted to a Certificate ...
0
votes
2answers
66 views

How is the digital certificate sent alongside digital signatures?

Most tutorials on the net only mention sending the digital signature attached to the document, but without the digital signature certificate, it'll be impossible for receivers to verify the signature. ...
0
votes
2answers
51 views

Why is it said that we can obtain a digital signature from a CA when all we obtain from the CA is a certificate?

Several sites, like this states that You can obtain a digital signature from a reputable certificate authority such as Sectigo But digital signature is something you create using a piece of text and ...
1
vote
1answer
31 views

Storing private keys for updates to remote device

I'm reading up on how to perform signed updates for remote hardware devices. I need to check if the new software has been generated by a "trusted" source, ie me. Based on my understanding of ...
0
votes
0answers
44 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
0
votes
1answer
94 views

Store credit card data in google sheets - Asymetric Encryption

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
0
votes
2answers
34 views

Transmit over CAN-FD a RSA-ecrypted and signed message, how to deal with message length?

As said in the title, I've to encrypt a message with RSA, generate a signature, and transmit everything over CAN-FD (suppose keys are already been exchanged). The problem is that a CAN-FD frame ...
0
votes
2answers
86 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
1answer
74 views

Compare fingerprints of gpg --verify for files download with / without TOR

From my understanding, except we meet the creator of an archive in person and verify the primary key fingerprint, we can never be sure, that the archive we download is really created by the person we ...
3
votes
1answer
76 views

how to associate a public key with a user of a website

I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he ...
1
vote
0answers
56 views

Is there a secure way to share a secret key to another entity without a use of PKI

My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
3
votes
2answers
173 views

“Digital” signatures on real life objects

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree. As an ...
11
votes
1answer
406 views

What gpg defaults can be improved, when performance is not an issue?

gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people. But, in a situation where speed ...
0
votes
1answer
151 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
0
votes
0answers
54 views

Digital signature verification with Client Certificates

We have a client server system implemented. Where client communicates using HTTP request. We have a one time token based authentication system and also sign the URL for authenticity. We do the ...
1
vote
1answer
97 views

Does Integrity assures protection from unauthorized read, without any modification?

I'm not quite sure if I understood integrity deep enough. Let's suppose that Alice and Bob are using a public-key algorithm and using signatures to assure their data integrity. A hacker was able to ...
0
votes
0answers
123 views

Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?

I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
1
vote
2answers
195 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
8
votes
2answers
2k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
2
votes
0answers
39 views

Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?

We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
0
votes
0answers
89 views

How is a cryptographic key used as a password when using WiFi? [duplicate]

I have recently come from a post and the accepted answer described the password as a cryptographic key. I have an understanding of RSA, AES and uses of it such as digital signatures however I fail to ...
0
votes
0answers
18 views

In Asymmetric public/private key over a web connection, how does the client decrypt what the server sends? [duplicate]

When I go to a secure site and they have a good certificate, etc., and they encrypt a message to me, I do not understand how I am decrypting it. Where did I, the client, get the private key to ...
1
vote
3answers
304 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
0
votes
1answer
123 views

Is asymmetric encryption is safe on the Internet? Can't a hacker just pose as a valid user?

When I read the RSA asymmetric encryption: In the environment: Rules are: blue boy, red girl, and black men. blue boy and red girl all have their own public key (blue) and private key (red). In ...
0
votes
1answer
336 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
1
vote
0answers
61 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
0
votes
1answer
109 views

For encrypted chat app, how can I store sent messages so that they are encrypted but still can be viewed by the sender?

Actual implimentaton will be in android but this is more about general security than actual implimentaton details. I'm making an end-to-end encrypted chat app and I know that in order to send ...
3
votes
0answers
190 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
5
votes
1answer
783 views

Asymmetric or symmetric - which makes sense in this scenario?

I am creating a system in which there will be oe client and one server. The client is periodically (every 5 or 10 secs) going to send a small amount of data to the server (with UDP). I am able to ...
3
votes
1answer
167 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
1
vote
1answer
325 views

OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?

I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
-1
votes
1answer
634 views

want to know best way to my case is to encrypt the UART communication channel? [closed]

I have device connected to scooter it’s 4- wire uart communication. My fear is some can read the ascii data and send the at commands and unlock my scooter and steal the scooter. I want to secure the ...
0
votes
1answer
289 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
2
votes
1answer
249 views

How to combine symmetric and asymmetric encryption to encrypt large files?

I understand that it is possible to combine symmetric and asymmetric encryption in a way that makes use of the performance of symmetric encryption, and also getting the benefits of being able to ...
0
votes
2answers
137 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
126 views

Is this strategy end 2 end encryption and secure?

I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please. The workflow is as follows: A customer indicates they want to ...
1
vote
2answers
99 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
1answer
352 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
-2
votes
1answer
91 views

Which scheme provides the shortest public key, while being secure? [closed]

I was wondering about whether there exists a scheme that would have the following properties: Be asymmetric (Encrypt with public key, decrypt with private key) Be secure by today's standards (as hard ...
2
votes
3answers
338 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
2
votes
1answer
97 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
0
votes
1answer
607 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
1
vote
1answer
213 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
1
vote
0answers
120 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
0
votes
2answers
151 views

Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt?

Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256. A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv ...
6
votes
4answers
3k views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
1
vote
1answer
96 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
2answers
64 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
3
votes
4answers
196 views

Asymmetric Encryption

I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...

1
2 3 4 5