Questions tagged [asymmetric]
Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.
300
questions
0
votes
2
answers
550
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
CommunityBot
- 1
0
votes
0
answers
32
views
How much data is signed during TLS handshakes?
My general understanding is that in server-only TLS, the connection establishment proceeds like so:
Client opens a TCP connection to the server, passing SNI and other data such as supported ciphers/...
- 6,753
1
vote
1
answer
282
views
How best to cryptographically sign scientific papers?
Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone.
Usually these aren't high-...
CommunityBot
- 1
0
votes
2
answers
54
views
Asymmetric crypto algorithm for encryption with hardware token
Our product stores voucher data in a database.
These voucher data can be retrieved with our app to display a voucher that can be used for payments.
Obviously, these voucher data are extremely ...
- 46.3k
1
vote
1
answer
73
views
Write message that can be verified by any member of a group
I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by.
There may be tens of messages generated each ...
- 339
0
votes
1
answer
227
views
Consequences of stolen TLS private key
My understanding is that, when you connect to an HTTPS website, the communication is encrypted via asymmetric encryption, therefore private and public keys play a role there. My assumption there is ...
- 46.3k
1
vote
1
answer
102
views
Is SRP/PAKE equivalent to an asymmetric crypto challenge?
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
- 111
1
vote
3
answers
131
views
Is it possible to generate a read-only key for a symmetrical encryption (AES)?
I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the ...
- 18.8k
0
votes
0
answers
60
views
Could a trusted CA pretend to be me and run a MITM? [duplicate]
Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
- 198k
3
votes
2
answers
2k
views
Create encryption key from decryption key (password)?
Alice has a password that she would like to use for decryption. Alice isn't able to store any other information, but she has access to any program/mechanism you choose.
How can she create an ...
- 263
8
votes
6
answers
6k
views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice.
Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 10.2k
0
votes
1
answer
53
views
Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
- 46.3k
0
votes
1
answer
166
views
How to handle private keys in a messenger app with asymmetric encryption?
I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side.
I generate a private and public key on server side and encrypt the messages ...
- 598
3
votes
2
answers
521
views
Does jwt with asymmetric algorithm have a bad performance?
I'm using Envoy as the gateway of my micro-service backend.
Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key.
...
- 3,134
2
votes
1
answer
370
views
Asymmetric encryption in case of multiple parties
For the consumer of the API to send and receive, encrypt and decrypt into that same API, wouldn't the client consumer also have to have the same public and private key as the server that provides the ...
- 301
1
vote
2
answers
222
views
What are the benefits of using WebAuthn?
The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following:
Server sends a challenge (16 ...
- 181
1
vote
2
answers
198
views
Using asymmetric encryption as authentication over HTTP?
I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I ...
- 18.8k
11
votes
4
answers
9k
views
Recommended asymmetric algorithms for JWT?
I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
2
votes
1
answer
468
views
Key management: Can I delete private key in asymmetric encryption?
If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?
For example with a JWT, or a file hash use for audit at a later date, ...
- 123
0
votes
2
answers
213
views
Asymmetric encryption and data sharing
I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
- 12.2k
2
votes
1
answer
188
views
How to use (py)NaCl/libsodium for key wrap, key encapsulation
We want to wrap / encapsulate
a symmetric key with an asymmetric keypair,
a symmetric key with a symmetric key,
a private key with a symmetric key.
In each case, we'd like to allow several keys to ...
- 298
1
vote
2
answers
152
views
How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand
Both hosts have just their public and private key pair (but they do not have the other party’s public key).
Bob should be authenticated
Assume that the two hosts share clocks that are synced, i.e ...
CommunityBot
- 1
0
votes
2
answers
133
views
Changing private key in asymmetric encryption and recovering data
Let's say I want to make an encrypted message app (just an example). So, I will need a user1 with a password1, private key1 (that will be encrypted with the password1), public key1 (that will depend ...
CommunityBot
- 1
0
votes
1
answer
455
views
Public / Private Key Cryptography for offline systems
Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography?
Is it a must to ...
CommunityBot
- 1
1
vote
1
answer
122
views
Will the public-key cryptosystem change in a post-quantum state?
I would like to preface this with the information that I am clearly not well versed in crypto, so my understand so far may not be accurate.
CISA recently published an advisory Preparing Critical ...
- 198k
0
votes
0
answers
3k
views
Store a symmetric key in Java Keystore
It is common to use store key pairs in Keystores. I need to store a symmetric key and distribute it in different servers (which are running set of Spring Micro services)
How exactly can I do that and ...
- 947
2
votes
1
answer
948
views
Can I change expiration date of a gpg key I've already sent to a key server?
ArchLinux wiki page on GnuPG reads
Once a key has been submitted to a keyserver, it cannot be deleted from the server.
Does that mean that also the expiration date with which I published the key via ...
CommunityBot
- 1
139
votes
11
answers
63k
views
Is it completely safe to publish an ssh public key? [duplicate]
I use a RSA key to log into remote servers with ssh. And I keep my dot files under version control in a publicly accessible place so that I can quickly setup new servers to work the way I like.
...
- 7,692
0
votes
0
answers
52
views
In asymmetric encryption, is there a meaningful difference between the public and the private key? [duplicate]
Is it possible to swap them, so that the public key is kept secret while the private key is public? Or do they actually function differently?
Thinking specifically about DSA though I'm interested if ...
- 1,259
3
votes
4
answers
436
views
Asymmetric Encryption
I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...
- 5,487
0
votes
0
answers
83
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
1
vote
0
answers
25
views
Does the the key used to encrypt in a ransomware attack reside on the target computer for at least some time? [duplicate]
My understanding is that a ransomware uses the target computer's resources to encrypt files. So does that mean that the key used for encryption resides on the target computer for at least some time? I ...
- 4,066
0
votes
0
answers
38
views
Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password
please verify or explain how to do this properly.
I'm letting a user create keys from the client through a secure server.
I ask the user for a password on the client, then send the hashed password to ...
- 103
2
votes
1
answer
540
views
SQL Server Asymmetric Encryption Keys
I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
- 2,265
10
votes
5
answers
777
views
Secure application data transmission via SMS channel
There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from.
While there's ...
- 5,487
0
votes
2
answers
2k
views
How does digital signature algorithms work in a private / public key environment?
From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that:
In a public-key encryption system, any ...
- 5,487
0
votes
1
answer
49
views
Saving signed file on an encrypted drive using symmetric encryption
When using asymmetric encryption, signing and encryption are the same, but opposite, operations.
Say I have my drive encrypted with asymmetric encryption.
If I save a signed file to that drive, using ...
- 46.3k
1
vote
1
answer
255
views
Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?
In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH.
What about when an entry node communicating ...
- 22.7k
1
vote
1
answer
105
views
Standard for public-key authentication (separate from channel encryption)
Because of all the problems associated with "roll-your-own cryptography", I am looking for an existing standard for standalone authentication using asymmetric keys.
Scenario/threat model
...
- 2,017
1
vote
1
answer
680
views
How are session keys transferred between a client and a server?
Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE.
However, I have heard that session keys are single-use, which mean a ...
- 1,982
0
votes
1
answer
964
views
GPG4WIN Kleopatra does not require RSA secret key components to decrypt
I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted ...
- 53
2
votes
1
answer
8k
views
How does public/private key encryption work? [duplicate]
I looked this up a few times already, but I still don't really understand how public/private key encryption works. The wikipedia page on public-key cryptography says this:
Public key cryptography,...
- 128k
0
votes
0
answers
123
views
decryption of message using private key [duplicate]
I don't why we can decrypt the message using our private key if it's encrypted using our public key.
If a message is encrypted using my public key, then how can I decrypt it using my private key? It ...
- 128k
4
votes
1
answer
597
views
Asymmetric encryption of very small messages
I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and ...
- 9,284
3
votes
2
answers
2k
views
Is an >=2048bit key with Asymmetric encryption secure enough to negotiate a Symmetric encryption key?
Let's say that a client app already knows the public key of the server to which it needs to communicate with and the client app needs to connect to the server using a normal non-secured internet ...
- 105
62
votes
7
answers
78k
views
Asymmetric vs Symmetric Encryption
I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
- 105
3
votes
1
answer
734
views
Authentication handshake between two independent apps
I need help on a solution for below scenario from a security perspective.
Scenario:
There are two independent web applications App1 and App2.
User will log in to App1 by performing authentication ...
CommunityBot
- 1
0
votes
1
answer
128
views
What are the different combinations of public and private keys and what CIA do they provide?
I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
- 22.7k
0
votes
1
answer
457
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
0
votes
1
answer
138
views
How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]
Using the cipher suite “TLS_AES_128_CCM_SHA256”
This example is referring to a self signed certificate
If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
- 811