Questions tagged [asymmetric]
Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.
43
questions
298
votes
11
answers
469k
views
"Diffie-Hellman Key Exchange" in plain English
Can someone explain what the Diffie-Hellman Key Exchange algorithm in plain English? I have read that Twitter has implemented this technology which allows two parties to exchange encrypted messages on ...
user15119
202
votes
8
answers
107k
views
Why not use larger cipher keys?
RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
- 1,663
29
votes
6
answers
7k
views
Principle of asymmetric algorithm in plain english
I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
- 393
62
votes
7
answers
79k
views
Asymmetric vs Symmetric Encryption
I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
- 1,080
38
votes
3
answers
23k
views
What specific padding weakness does OAEP address in RSA?
It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks.
Can someone elaborate this in better detail? I'd specifically like to know the ...
- 2,193
2
votes
1
answer
2k
views
Password based Asymmetric Key generation
I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
22
votes
4
answers
10k
views
What asymetric scheme provides the shortest signature, while being secure?
I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties :
Be asymmetric (one ...
- 323
15
votes
5
answers
49k
views
Is there a simple example of an Asymmetric encryption/decryption routine?
I can understand Java, Perl and JavaScript code very well. The rest, I have not studied, but I guess I could figure out how to read/translate.
I would like to know what the simplest of Asymmetric ...
- 14k
8
votes
3
answers
3k
views
What are the disadvantages of using public key cryptography when encrypting files? [duplicate]
I am wanting to encrypt a file with my public key, my friend told me that this is not a good idea but did not explain why. Can someone explain please.
- 315
8
votes
1
answer
13k
views
What is the difference between Key, Certificate and Signing in GPG?
Forgive me the newbie questions.
I'm going through the Gpg documentation and other related websites. Unfortunately they assume I am already familiar with some terms and allthough I am re-searching ...
- 203
3
votes
3
answers
5k
views
How does the digital signature process work?
I'm trying to understand the process of digital signature verification, however I don't quite get the explanation in my book.
If A wants to send a message to B with a digital signature, the process ...
- 131
2
votes
3
answers
5k
views
Storing User's Private Keys in DB
I have the need to store private keys for multiple users, so that my server application can sign files on their behalf. I want to store these keys securely, but couldn't find much information on this ...
- 133
2
votes
3
answers
1k
views
With GPG, can 3rd party verify that message has been encrypted by specific public key?
Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext).
Later Alice claims that Bob made a mistake and the ciphertext was not ...
- 123
2
votes
1
answer
8k
views
How does public/private key encryption work? [duplicate]
I looked this up a few times already, but I still don't really understand how public/private key encryption works. The wikipedia page on public-key cryptography says this:
Public key cryptography,...
- 123
0
votes
1
answer
4k
views
Diffie–Hellman key exchange in TLS 1.3
I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and ...
- 51
143
votes
11
answers
72k
views
Is it completely safe to publish an ssh public key? [duplicate]
I use a RSA key to log into remote servers with ssh. And I keep my dot files under version control in a publicly accessible place so that I can quickly setup new servers to work the way I like.
...
- 1,401
51
votes
3
answers
82k
views
Which host key algorithm is best to use for SSH?
When you first connect to an SSH server that is not contained inside your known_hosts file your SSH client displays the fingerprint of the public key that the server gave. I found from this question ...
- 839
50
votes
4
answers
8k
views
Why is key exchange necessary at all?
Let's say "Alice" and "Bob" want to communicate with each other over an insecure network.
Using Diffie–Hellman key exchange, they can get the same symmetric key at last. However, as I understand, ...
- 513
38
votes
7
answers
12k
views
How dangerous might be publishing a public key? [duplicate]
Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system?
I know public keys are meant for encrypting messages by anyone who'...
- 689
24
votes
1
answer
13k
views
Why a symmetric key for HMAC?
I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
- 243
17
votes
1
answer
5k
views
Why is asymmetric encryption less efficient than symmetric encryption?
It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
- 173
15
votes
2
answers
44k
views
How X509 Certificates are used for Encryption
I have small doubt regarding the process of X509.
I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
- 253
13
votes
3
answers
32k
views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
- 591
13
votes
1
answer
770
views
Recommended operational security for generating one's primary key pair?
I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
- 403
13
votes
4
answers
11k
views
Recommended asymmetric algorithms for JWT?
I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
- 133
10
votes
3
answers
4k
views
Is it possible to prove which public key was used to encrypt a message?
Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the ...
- 2,292
8
votes
6
answers
6k
views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice.
Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 549
8
votes
5
answers
15k
views
Is asymmetric encryption vulnerable to man-in-the-middle attacks?
I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
7
votes
2
answers
2k
views
JWT or public-private keys for service to service API calls
I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else.
I ...
- 185
5
votes
1
answer
5k
views
What is the difference between a digital signature and whole message encryption?
I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message.
Lets consider simple example of email message.
I understand how ...
- 175
5
votes
2
answers
1k
views
ProtonMail: Wouldn't it be better if each user had their own private key?
ProtonMail keeps the encrypted private keys of all their users on their servers. The mailbox password, which is known only to the user, decrypts the private key of that user.
Would it not actually be ...
- 486
4
votes
3
answers
5k
views
Is a 512 bit RSA key secure when used temporary?
Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data.
This is for a system where ...
- 391
3
votes
2
answers
610
views
Asymmetric Cryptography as Hashing Function
Could I replace password hashing with the following strategy:
Generate a public/private key pair, store the public key as the "salt" and destroy the private key. Maybe we could even not generate the ...
- 133
3
votes
2
answers
4k
views
Does asymmetric encryption guarantee data integrity?
I have some unusual size constraints for my data which may be relevant to the prescribed solution.
The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by ...
- 33
3
votes
3
answers
3k
views
Why do you need to encrypt symmetric key?
I'm reading this pki article and as you can see near the bottom, the quick animation and description:
The sending computer encrypts the document with a symmetric key, then encrypts the symmetric ...
- 133
2
votes
1
answer
717
views
How to combine symmetric and asymmetric encryption to encrypt large files?
I understand that it is possible to combine symmetric and asymmetric encryption in a way that makes use of the performance of symmetric encryption, and also getting the benefits of being able to ...
- 1,063
1
vote
2
answers
792
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
- 185
1
vote
1
answer
374
views
Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?
In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH.
What about when an entry node communicating ...
- 71
1
vote
3
answers
2k
views
In message signing, is the digest encrypted with a generated symmetric key or with the sender's private key?
I understand the encryption process uses a generated symmetric key to encrypt a message, and then encrypts the symmetric key with the receiver's public key before it is sent across the wire. This ...
- 781
1
vote
3
answers
3k
views
How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL
I want to do an asymmetrical file encryption:
openssl genrsa -des3 -out private.key 4096
openssl rsa -in private.key -pubout -out public.key
openssl rsautl -encrypt -pubin -inkey public.key -in a -...
- 1,811
0
votes
2
answers
76
views
Is there an asymmetric TOTP algorithm that avoids sharing a private key over public channels?
The commonly used Time based One Time Password (TOTP) system requires the initial sharing of a key. This presents a security risk, as acknowledged by Wikipedia referencing the RSA compromise:
An ...
- 323
0
votes
1
answer
714
views
How to manage a users private key in a secure document storage solution?
I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
- 101
-1
votes
2
answers
847
views
Why can't the RSA algorithm be used for symmetric key infrastructures?
If RSA is an encryption algorithm used to create an asymmetric key pair and digital signature, why can't it also be used to create a symmetric key?
Even if RSA is used to create public keys, why can'...
