Hot answers tagged

115 votes
Accepted

Will quantum computers render AES obsolete?

Quantum computing will change the encryption game, but it is not yet clear how much it will change. It's not clear because we are not yet certain what sorts of problems quantum computers can solve. ...
user avatar
  • 9,206
113 votes
Accepted

Why OpenSSH deprecated DSA keys

This is a good question. The dedicated page from OpenSSH only says: OpenSSH 7.0 and greater similarly disables the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use. ...
user avatar
  • 168k
104 votes
Accepted

Is it bad that my ed25519 key is so short compared to a RSA key?

No, longer is not better. Let me explain. In symmetric cryptography, keys are just bunches of bits, and all sequences of bits are valid keys. They have no internal structure. Provided that you use ...
user avatar
  • 168k
101 votes

SSH Key: Ed25519 vs RSA

Key strengths, and their equivalences, become meaningless when they reach the zone of "cannot be broken with existing and foreseeable technology", because there is no such thing as more ...
user avatar
  • 168k
73 votes

Can I get a public key from an RSA private key?

can I get a public key? It's easy using openssl rsa: $ openssl rsa -in the-private-key-from-your-question.pem -pubout writing RSA key -----BEGIN PUBLIC KEY----- ...
user avatar
58 votes

What is RSA OAEP & RSA PSS in simple terms

"Textbook"/"raw"/"unpadded" RSA has an "oops, the real world happened" problem. Consider any RSA key whose modulus is 4096-bit. It should be nearly impossible ...
user avatar
  • 1,693
57 votes
Accepted

Why is key exchange necessary at all?

If the attacker is able to passively capture data and later gets access to the private key of the certificates (i.e. stealing, heartbleed attack or law enforcement), then the attacker could decode all ...
user avatar
47 votes

How does OpenSSL generate a big prime number so fast?

Testing for primality is much easier than performing integer factorization. There are several ways to test for primality, such as the deterministic Sieve of Eratosthenes and the probabilistic Miller–...
user avatar
  • 64k
42 votes
Accepted

New PGP key: RSA/RSA or DSA/Elgamal?

since it's known that the NSA infiltrated RSA and made their key generation algorithm weaker If you know that, then you know wrong. You are confusing two things which have no relation whatsoever: ...
user avatar
41 votes

Can I get a public key from an RSA private key?

In practice, yes, you can get the public key from the private key. In principle, it would be possible to create an RSA private key from which the corresponding public key cannot be easily obtained, ...
user avatar
40 votes

Why don't folks seem to use ECC for TLS root certificate signature?

There's a slide deck on NIST by Rick Andrews, Senior Technical Director and Distinguished Engineer of Symantec, titled Symantec’s View of the Current State of ECDSA on the Web (published 2015) ...
user avatar
  • 1,042
38 votes

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

RSA is two algorithms, one for asymmetric encryption, the other one for digital signatures. They use the same kind of keys, they share the same core operation, and they are both called "RSA". Diffie-...
user avatar
38 votes
Accepted

Converting ECC Private key to PKCS#1 format

There might be a bit of confusion here between "RSA Laboratories", the organization that edits the PKCS standards, and RSA, the cryptographic algorithm. PKCS#1 is one of the PKCS standards, ...
user avatar
37 votes
Accepted

RSA public key and private key lengths

> I saw different key sizes for RSA algorithm (512, 1024,... [bits] for example) but, is this the length of public key or the length of private key or both are equal in length? It's the length of the ...
user avatar
  • 5,040
35 votes
Accepted

Is this RSA/AES combination good?

All of the weaknesses in your protocol can be summed up as "use SSL" or even "use SSL, dammit !". In more details: All the protocol is of course vulnerable to impersonation, specifically the double ...
user avatar
35 votes
Accepted

PEM, CER, CRT, P12 - what is it all about?

openssl genrsa -out private.pem gives me a PEM file which includes only private key Not really. In principle RSA can store just a privatekey with no publickey, but the RSAPrivateKey format used by ...
user avatar
34 votes
Accepted

What are the odds of an RSA private key collision?

First, what matters is not having two identical private keys, if either of the prime numbers is the same in the modulus (which is part of the public key), it is easy to quickly recover the full ...
user avatar
  • 38.6k
32 votes
Accepted

How do RSA SecureID ® Keys Work?

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable ...
user avatar
31 votes
Accepted

How does SSH use both RSA and Diffie-Hellman?

The host key is used to sign the Diffie-Hellman parameters. It is used during the key exchange; RSA is a signature algorithm as well as an encryption algorithm. From what I can tell, the client key (...
user avatar
  • 7,133
27 votes

Why don't folks seem to use ECC for TLS root certificate signature?

TL;DR: There is nothing technically wrong with ECC; in fact it has better bandwidth and server CPU load than RSA (but higher CPU load on browsers, thanks @CodesInChaos), but for historical reasons it ...
user avatar
26 votes

Is allowing root login in SSH with "PermitRootLogin without-password" a secure method?

This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means ...
user avatar
  • 64k
24 votes
Accepted

Are SSH keys and PGP keys the same thing?

Yes, the same RSA key pair can be used for both (Open)SSL and OpenPGP/GnuPG. The monkeysphere project contains a tool to convert RSA keys in PEM format to the one defined by OpenPGP, pem2openpgp. For ...
user avatar
  • 23.1k
23 votes
Accepted

ssh-keygen: What is the passphrase for?

$ man ssh-keygen [...] It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this file using 128-bit AES. So this passphrase just ...
user avatar
  • 31.8k
22 votes

Trying to understand RSA and it's terminology?

The source of your confusion is an historical "explanation" of RSA signatures as being "encryption of the hash with the private key". This explanation is confusing, and flawed in ...
user avatar
22 votes
Accepted

How to ensure identity for server-to-server communication over IP

Basically you are trying to re-invent certificate based authentication since you only have an IP address and not a domain. But certificate based authentication can be used without a domain too, for ...
user avatar
21 votes
Accepted

Shall I set "RSAAuthentication yes" in sshd_config if I use only ECDSA key?

The option names are not part of the SSH protocol; they are specific to a given implementation. I suppose you are talking about OpenSSH. As per the documentation: RSAAuthentication Specifies ...
user avatar
20 votes
Accepted

Which host key algorithm is best to use for SSH?

Currently, RSA is still recommended as a gold standard (strong, wide compatible) ed25519 is good (independent of NIST, but not compatible with all old clients). Server is usually providing more ...
user avatar
  • 5,119
20 votes
Accepted

When exactly is Diffie-Hellman used in TLS?

DH is a key exchange algorithm, it is used to derive the session key that's later used in the symmetric encryption. DH by itself is not authenticated, so while you can derive the session key without a ...
user avatar
  • 31k
20 votes
Accepted

RSA key exchange

TL;DR: Skip to "Using result of DH". Because you started with "I want to create a message exchange program" together with "I don’t know how to use DH", a tedious preface: ...
user avatar
  • 7,603
19 votes

Can I determine a private key given the encrypted data and corresponding cleartext?

If the key can be recovered from knowing both a plaintext and the corresponding ciphertext, then this is called a known plaintext attack; an extension is the chosen plaintext attack where the attacker ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible