Questions tagged [asymmetric]
Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.
27
questions with no upvoted or accepted answers
3
votes
0
answers
159
views
Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?
I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1)
Basically, ...
- 31
3
votes
0
answers
437
views
Using asymmetric keys for two factor authentication
Here's what I'm trying to do:
Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
- 133
2
votes
0
answers
105
views
Is it possible to securely transfer a symmetric key to a VM instance with the use of vTPM?
We have a physical Xeon host (bare metal - BM host) with a hardware TPM installed on it. The BM host's attestation status is established at through boot-time measurements captured and written to the ...
- 21
2
votes
1
answer
539
views
SQL Server Asymmetric Encryption Keys
I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
- 121
1
vote
1
answer
281
views
How best to cryptographically sign scientific papers?
Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone.
Usually these aren't high-...
- 181
1
vote
0
answers
105
views
Is there a secure way to share a secret key to another entity without a use of PKI
My concern is with resource constrained devices with limited resources to perform verification of signatures e.g. RSA signature. What I know is that the asymmetric keys are use to determine that the ...
- 11
1
vote
0
answers
104
views
Security risks on returning encrypted JSON web token without prior authentication
I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
- 111
1
vote
0
answers
199
views
Client Side Encryption - The Last Mile
Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
- 111
1
vote
0
answers
64
views
What measures are used to protect private keys on credit card processing devices?
For example, a device that accepts credit card payment to update a store card. These are usually embedded devices with a hard drive for permanent storage. Would it not be possible for a hacker to ...
- 277
1
vote
0
answers
597
views
BadPaddingException when using the textbook cipher
I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
- 203
1
vote
0
answers
230
views
ROCA attack on TPM - public key extraction
I was reading about the ROCA attack, and how a lot of software is vulnerable. Apparently Bitlocker from Microsoft is also vulnerable, because it protects its keys with SRK of (ROCA vulnerable) TPM. ...
- 11
1
vote
0
answers
575
views
Curve25519xsalsa20poly1305 key derivation
I'm working on batch-encryption of files, for a small project of mine. The files are stored encrypted on a removable drive, and the keys are stored on a trustful server. For enhanced safety, I'd like ...
- 53
1
vote
0
answers
263
views
Passing Encryption Key Across Session for Symmetrically-Encrypted DB
I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to ...
0
votes
0
answers
31
views
How much data is signed during TLS handshakes?
My general understanding is that in server-only TLS, the connection establishment proceeds like so:
Client opens a TCP connection to the server, passing SNI and other data such as supported ciphers/...
- 6,753
0
votes
0
answers
81
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
0
votes
0
answers
37
views
Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password
please verify or explain how to do this properly.
I'm letting a user create keys from the client through a secure server.
I ask the user for a password on the client, then send the hashed password to ...
- 103
0
votes
0
answers
101
views
asymmetric file system authentication
Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
- 158
0
votes
2
answers
544
views
How do I do asymmetric/hybrid encryption in practice?
Question
I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated.
What do ...
- 175
0
votes
0
answers
79
views
Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?
This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
- 1
0
votes
0
answers
113
views
Asymmetric Encrypted Container
I'd like to set up a remote backup for my PC. I want to have it run at scheduled times, encrypting the data locally and then transmitting it to the server. I'd like to use something popular and open ...
- 101
0
votes
0
answers
321
views
Saving secrets (API-keys for external application) per user in database (PKI?)
I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end.
Each user on my app ...
0
votes
0
answers
228
views
Is there a standard approach for serializing an RSA encrypted AES key alongside the AES payload itself?
Diffie-Hellman won't really work here, since only one side has a public key, one side has the private. It must be this way to prevent decryption when the data is at-rest on one of the sides before ...
- 101
0
votes
0
answers
277
views
Parameters for HSM based symmetric Key Derivation Function (KDF)
I have a quick question regarding parameters for HSM based symmetric Key Derivation.
My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
- 1
0
votes
0
answers
282
views
Is there any Password Manager that supports Hardware-Based OTP encryption/decryption?
I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-...
- 189
0
votes
0
answers
91
views
Public encryption scheme where decryption key become valid on certain timestamp?
I am looking for a solution in asymmetric cryptography where the decryption will only be possible after a certain condition i.e. after certain time passed or on certain date. The key and cipher should ...
- 526
0
votes
0
answers
199
views
Elgamal encryption algorithm
I have question about elgamal algorithm, Why NIST do not certified this algorithm, And every implementation of this algorithm in Python language have Vulnerability?
- 187
0
votes
0
answers
3k
views
Store a symmetric key in Java Keystore
It is common to use store key pairs in Keystores. I need to store a symmetric key and distribute it in different servers (which are running set of Spring Micro services)
How exactly can I do that and ...
- 1,287