Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [asymmetric]

Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.

0
votes
0answers
29 views

How Asymmetric algorithm's cipher text can be rerandomized without knowldge of secret key?

As public key algorithm Elgamal's cipher text can be re-encrypted using its homomorphic property and can be used in many application i,e Mixnets. I want some other public key algorithm can behave ...
3
votes
0answers
74 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
5
votes
1answer
769 views

Asymmetric or symmetric - which makes sense in this scenario?

I am creating a system in which there will be oe client and one server. The client is periodically (every 5 or 10 secs) going to send a small amount of data to the server (with UDP). I am able to ...
0
votes
1answer
72 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
1answer
68 views

OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key?

I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its ...
-1
votes
0answers
68 views

Is there any sense in encrypting a file for one's own later use?

Let's say you have a single sensitive document. You're traveling to somewhere high risk and are advised not to bring your data, but you also don't have safe storage at home. So you encrypt your ...
-1
votes
1answer
86 views

want to know best way to my case is to encrypt the UART communication channel? [closed]

I have device connected to scooter it’s 4- wire uart communication. My fear is some can read the ascii data and send the at commands and unlock my scooter and steal the scooter. I want to secure the ...
0
votes
1answer
70 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
1
vote
1answer
93 views

How to combine symmetric and asymmetric encryption to encrypt large files?

I understand that it is possible to combine symmetric and asymmetric encryption in a way that makes use of the performance of symmetric encryption, and also getting the benefits of being able to ...
0
votes
2answers
71 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
101 views

Is this strategy end 2 end encryption and secure?

I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please. The workflow is as follows: A customer indicates they want to ...
1
vote
2answers
70 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
0
votes
1answer
89 views

Asymmetric/Symmetric Encryption of a TPM key hierarchy

I know that keys in a TPM key hierarchy are encrypted with their parent keys. But I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
-2
votes
1answer
79 views

Which scheme provides the shortest public key, while being secure? [closed]

I was wondering about whether there exists a scheme that would have the following properties: Be asymmetric (Encrypt with public key, decrypt with private key) Be secure by today's standards (as hard ...
2
votes
3answers
120 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
2
votes
1answer
85 views

How to Manage Public Key with Asymmetric Cryptography

I'm working on an iOS chat project using Firebase RealTime Database. I want to use asymmetric cryptography for the management of messages between two users .. Browsing the net I found an excellent ...
0
votes
1answer
600 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
1
vote
1answer
133 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
1
vote
0answers
65 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
0
votes
2answers
120 views

Is it secure to send a RSA-wrapped symmetric key along with the payload it was used to encrypt?

Given key K, salt Salt which is 32 randomly generated bytes is used to derive keys EKey and AKey using HKDF-SHA256. A Ciphertext is produced using AES-256-CBC with key EKey and a random 16-byte iv ...
1
vote
3answers
333 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
1
vote
1answer
53 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
2answers
50 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
3
votes
4answers
138 views

Asymmetric Encryption

I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...
0
votes
2answers
49 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
1
vote
0answers
25 views

What measures are used to protect private keys on credit card processing devices?

For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
0
votes
1answer
106 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
0
votes
1answer
908 views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
0
votes
0answers
37 views

Public encryption scheme where decryption key become valid on certain timestamp?

I am looking for a solution in asymmetric cryptography where the decryption will only be possible after a certain condition i.e. after certain time passed or on certain date. The key and cipher should ...
1
vote
0answers
231 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
3
votes
1answer
121 views

Publishing a private key as a way to revoke it?

Academically, I've been thinking of a system where every user has identities tied to private/public key pairs. A Web Of Trust style of verifying other users builds trust in who is who. If you want to ...
0
votes
1answer
113 views

How Symmetric key Occurs in SSH? [duplicate]

How Symmetric Key occurs in SSH process? As I think that the Asymmetric key used for the only Authentication but my main problem is "How Server generates the Symmetric Key which will use to do secure ...
0
votes
2answers
1k views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
0
votes
0answers
68 views

Elgamal encryption algorithm

I have question about elgamal algorithm, Why NIST do not certified this algorithm, And every implementation of this algorithm in Python language have Vulnerability?
13
votes
1answer
2k views

Why is asymmetric encryption less efficient than symmetric encryption?

It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
2
votes
1answer
590 views

Collision-free cryptographic hashing?

I wish to hash something that outputs a collision-free hash, and to use that hash as an id in a database. Using conventional cryptographic hashing (fixed-length) means there is a chance of collision, ...
-1
votes
3answers
334 views

How are private keys distributed safely?

I am going through the RSA algorithm and I have a few questions. My understanding of RSA Algorithm: How does a receiver get his private keys P and Q? For a particular public key, if every receiver ...
2
votes
1answer
182 views

Why are private keys alpha-numeric?

In asymmetric encryption, if a private key is in-fact the multiplication of 2 prime numbers, then how come it is alphanumeric?
2
votes
1answer
268 views

Encrypt a body instead of Signing it (with JWT for example)

What would be the issue if I encrypt the "claims/body/data" and I send it to the user, then when the user sends me this encrypted token, I decrypt it I trust it, and operate on the data in it (If it's ...
-5
votes
1answer
726 views

Does WhatsApp use asymmetric encryption?

I know that WhatsApp uses some kind of encryption to encrypt messages, but is it asymmetric encryption? If not what kind of encryption does it use?
2
votes
2answers
627 views

Does asymmetric encryption guarantee data integrity?

I have some unusual size constraints for my data which may be relevant to the prescribed solution. The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by ...
4
votes
2answers
698 views

JWT or public-private keys for service to service API calls

I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else. I ...
-2
votes
2answers
130 views

Why can't the RSA algorithm be used for symmetric key infrastructures?

If RSA is an encryption algorithm used to create an asymmetric key pair and digital signature, why can't it also be used to create a symmetric key? Even if RSA is used to create public keys, why can'...
1
vote
1answer
361 views

2048 bit SSH RSA public key vs AWS KMS-encrypted text in source control

I'm trying to work out how acceptable it is to commit KMS-encrypted API keys to source control. It is (I believe) often deemed acceptable to commit public keys to source control. So, to try to compare ...
4
votes
2answers
166 views

Symmetric encryption for data protection

My team is working on a solution to store sensitive information on a remote storage solution. I am proposing that we use symmetric encryption of the data where there is a unique key per document. ...
1
vote
3answers
372 views

How does the Certificate Authority work [duplicate]

I'm learning how the Certificate Authority work and have a question. As my understanding, the Certificate Authority can guarantee that the client get the true public-key: Saying that I'm a server and ...
0
votes
3answers
166 views

Can a malicious SSH server successfully *pretend* to know a client's public key?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and ...
1
vote
1answer
81 views

Can JavaScript encryption's problems be mitigated?

Earlier this year, I was asked to evaluate using JavaScript to encrypt sensitive information in the user's browser before sending it to our server. While my first response was "ask an expert", my boss ...
1
vote
0answers
128 views

Are there any good instant messaging applications with a good end-to-end encryption to its web application? [closed]

Whether an app like Telegram is secure or not has already been answered and it has recently been confirmed that it is not. Apps like Signal and Cryptocat have been recommended instead. But do these ...
0
votes
1answer
61 views

Question on DH key exchange

The server is configured to support the cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA and validate the client's certificate. My understanding is that the server uses DH for key exchange which does ...