Questions tagged [asymmetric]
Asymmetric cryptography, or public-key cryptography, is the foundation of security protocols that do not require shared secrets.
300
questions
298
votes
11
answers
467k
views
"Diffie-Hellman Key Exchange" in plain English
Can someone explain what the Diffie-Hellman Key Exchange algorithm in plain English? I have read that Twitter has implemented this technology which allows two parties to exchange encrypted messages on ...
user15119
201
votes
8
answers
107k
views
Why not use larger cipher keys?
RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
- 1,653
139
votes
11
answers
63k
views
Is it completely safe to publish an ssh public key? [duplicate]
I use a RSA key to log into remote servers with ssh. And I keep my dot files under version control in a publicly accessible place so that I can quickly setup new servers to work the way I like.
...
- 1,361
62
votes
7
answers
78k
views
Asymmetric vs Symmetric Encryption
I am currently taking a Principles of Information Security class. While talking about different encryption methods, a large number of my classmates seem to believe that Asymmetric Encryption is better ...
- 1,080
49
votes
4
answers
8k
views
Why is key exchange necessary at all?
Let's say "Alice" and "Bob" want to communicate with each other over an insecure network.
Using Diffie–Hellman key exchange, they can get the same symmetric key at last. However, as I understand, ...
- 503
47
votes
3
answers
74k
views
Which host key algorithm is best to use for SSH?
When you first connect to an SSH server that is not contained inside your known_hosts file your SSH client displays the fingerprint of the public key that the server gave. I found from this question ...
- 799
38
votes
7
answers
12k
views
How dangerous might be publishing a public key? [duplicate]
Maybe this question sounds obvious, but I wonder how dangerous might be publishing a public key for an asymmetric encryption system?
I know public keys are meant for encrypting messages by anyone who'...
- 679
38
votes
3
answers
22k
views
What specific padding weakness does OAEP address in RSA?
It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks.
Can someone elaborate this in better detail? I'd specifically like to know the ...
- 2,183
29
votes
6
answers
6k
views
Principle of asymmetric algorithm in plain english
I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
- 393
25
votes
5
answers
4k
views
Why is Bruce Schneier recommending symmetric crypto over public key crypto
I just read the article written by Bruce Schneier, the crypto guru. In the article, he says :
Prefer symmetric cryptography over public-key cryptography.
But, he doesn't shed any light as to why.
...
- 353
23
votes
1
answer
12k
views
Why a symmetric key for HMAC?
I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
- 233
22
votes
4
answers
9k
views
What asymetric scheme provides the shortest signature, while being secure?
I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties :
Be asymmetric (one ...
- 323
16
votes
1
answer
5k
views
Why is asymmetric encryption less efficient than symmetric encryption?
It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
- 163
16
votes
2
answers
54k
views
Ways to generate symmetric and asymmetric keys
We are using Beaglebone Black based custom board, and want to use hybrid encryption for encrypting firmware file, i.e. symmetric for encryption big firmware file and asymmetric for encrypting ...
- 293
15
votes
2
answers
43k
views
How X509 Certificates are used for Encryption
I have small doubt regarding the process of X509.
I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
- 253
14
votes
5
answers
49k
views
Is there a simple example of an Asymmetric encryption/decryption routine?
I can understand Java, Perl and JavaScript code very well. The rest, I have not studied, but I guess I could figure out how to read/translate.
I would like to know what the simplest of Asymmetric ...
- 14k
14
votes
1
answer
11k
views
difference between public key and host key and security of host key
In SSH, what is the difference between host key and public key.
Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
- 247
13
votes
3
answers
32k
views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
- 591
13
votes
1
answer
728
views
Recommended operational security for generating one's primary key pair?
I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
- 403
12
votes
4
answers
8k
views
Can data be decrypted with the public key if encrypted with the private key? [duplicate]
I am trying to understand the principles of asymmetric encryption, and have read the following in a book:
One key is completely public and can be read and used by everyone. The
other part is ...
- 269
12
votes
3
answers
4k
views
ProtonMail security concerns
This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
- 430
11
votes
4
answers
2k
views
Why the symmetric key is added to the message?
Yesterday in my class we learnt how to send a message from Alice to Bob with
the achieved goals of confidentiality, integrity and authenticity.
In order to have a better performance we use a hybrid ...
- 513
11
votes
4
answers
9k
views
Recommended asymmetric algorithms for JWT?
I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
- 113
11
votes
4
answers
4k
views
Is asymmetric encryption ever recommended for long-term storage?
Is asymmetric encryption ever recommended for long-term storage of data, is it advisable for example to store data in a database such that:
1) A user enters data on a website, it is encrypted using a ...
- 405
11
votes
0
answers
496
views
Strength and length of Symmetric vs Asymmetric keys [duplicate]
There are many questions surrounding the differences between symmetric and asymmetric encryption keys. I think I've read them all at this point. But I'm still left wondering:
Why does a "secure" ...
- 211
10
votes
3
answers
19k
views
Shared Secret, is it a public key or a private key?
Reading the Diffie-Hellman non mathematical explanation i found that some mathematical operations are performed on private-key and the recipient's public key to generate a "shared secret" on both ends ...
- 2,753
10
votes
1
answer
974
views
What gpg defaults can be improved, when performance is not an issue?
gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people.
But, in a situation where speed ...
- 2,149
10
votes
5
answers
776
views
Secure application data transmission via SMS channel
There are mobile banking applications that use SMS channel to communicate with their server. Some of them offer both internet and sms channels which the customer gets to choose from.
While there's ...
- 3,387
10
votes
1
answer
9k
views
How secure is GPG symmetric encryption?
Since I am new to encryption and have recently been losing stuff, I decided to start a file that contains some passwords for online accounts and whatnot, encrypt it, back it up (and keep a single copy ...
- 199
9
votes
3
answers
4k
views
Is it possible to prove which public key was used to encrypt a message?
Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the ...
- 2,272
9
votes
2
answers
7k
views
Does public key auth in SSH prevent most MITM attacks?
I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM:
http://www.gremwell.com/ssh-mitm-public-key-authentication
Key idea:
The value of 'signature' is a ...
- 91
8
votes
6
answers
6k
views
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
Lets say Bob wishes to communicate with Alice.
Alice's public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to ...
- 549
8
votes
2
answers
8k
views
How to encrypt using a private key file generated by OpenSSL?
When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
- 99
8
votes
1
answer
12k
views
What is the difference between Key, Certificate and Signing in GPG?
Forgive me the newbie questions.
I'm going through the Gpg documentation and other related websites. Unfortunately they assume I am already familiar with some terms and allthough I am re-searching ...
- 203
8
votes
3
answers
3k
views
What are the disadvantages of using public key cryptography when encrypting files? [duplicate]
I am wanting to encrypt a file with my public key, my friend told me that this is not a good idea but did not explain why. Can someone explain please.
- 315
8
votes
3
answers
17k
views
Why is RSA decryption slow?
I've been researching the disadvantages of using RSA for encryption, and one I've found repeatedly is that RSA decryption is slow, but I haven't seen an explanation as to why this is. Can anyone ...
Harry
8
votes
1
answer
354
views
Main difference between Yahalom and Needham-Schroeder key exchange protocols
I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
- 81
7
votes
5
answers
4k
views
Why do the roles of public/private keys reverse when talking about public key encryption and digital signatures?
With public key encryption you encrypt using a public key. But when creating digital signatures you sign by encrypting a hash using a private key.
I understand the principles of these two uses of ...
- 180
7
votes
5
answers
14k
views
Is asymmetric encryption vulnerable to man-in-the-middle attacks?
I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
7
votes
2
answers
2k
views
Why can I sign but not encrypt?
-edit- After following a chain of links from this question I see this is similar/duplicate of Why should one not use the same asymmetric key for encryption as they do for signing? but this question ...
user5575
7
votes
2
answers
1k
views
Can symmetric key cryptography provide identification?
I understand that PKI uses digital certificates to link a public key to an entity, but is there anything similar for symmetric cryptography.
If, theoretically, PKI didn't exist, how do you know you ...
- 311
7
votes
2
answers
2k
views
JWT or public-private keys for service to service API calls
I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else.
I ...
- 185
7
votes
3
answers
2k
views
Public Key Encryption instead of passwords
As an alternative to using passwords, customers could be provided with individual asymmetric-encryption key pairs (i.e. a private key with associated public key), which could be used to validate their ...
- 71
5
votes
1
answer
14k
views
Checking if an RSA private key is passphrase protected
I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.
Note that the problem is not that I forgot the passphrase, but ...
- 965
5
votes
2
answers
5k
views
What asymmetric encryption algorithms are in common use beside RSA?
I am looking for an asymmetric encryption algorithm other than RSA?
- 259
5
votes
3
answers
7k
views
How does the Certificate Authority work [duplicate]
I'm learning how the Certificate Authority work and have a question.
As my understanding, the Certificate Authority can guarantee that the client get the true public-key:
Saying that I'm a server and ...
- 341
5
votes
3
answers
4k
views
Why would a public key have a passphrase?
Last week I wrote to my bank with a general question. Today I received an email inviting me to join their "Secure Email (PGP) system". It made clear I'd have to join to read their response to my ...
- 2,144
5
votes
1
answer
1k
views
Most efficient key algorithm for a TLS server key?
Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator.
Which key algorithm should I choose for the server key in ...
5
votes
1
answer
836
views
Asymmetric or symmetric - which makes sense in this scenario?
I am creating a system in which there will be oe client and one server.
The client is periodically (every 5 or 10 secs) going to send a small amount of data to the server (with UDP).
I am able to ...
- 53
5
votes
1
answer
4k
views
What is the difference between a digital signature and whole message encryption?
I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message.
Lets consider simple example of email message.
I understand how ...
- 175