Authentication is successfully validating that an entity you are communicating with is actually who they claim to be. The entity typically demonstrates who they are by showing they possess a secret that only they could know.

learn more… | top users | synonyms

0
votes
0answers
33 views

Transport SA bundled inside a tunnel with encryption applied before authentication?

For IPsec I am considering different formats of ESP encryption and authentication. I am not sure what happens with "Transport SA bundled inside a tunnel with encryption applied before ...
0
votes
0answers
64 views

What is the best authentication logic to analyze RFID (randomized hash-lock) authentication protocol?

What is the best authentication logic to analyze RFID (Randomized hash-lock) authentication protocol, (Ban logic, GNY logic, SVO logic, VO logic, AT logic) or another one?
4
votes
1answer
2k views

What is “Implicit Authentication”?

What is “Implicit Authentication” in the context of authentication methods? I searched the Web but could not find any article that describes this. If anyone can describe it, that would be a great ...
2
votes
1answer
138 views

What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?

Say Alice and Bob have a shared secret $s$. Alice and Bob establish an encrypted channel and verify that it hasn't been MitM'ed by exchanging $r_1$ and $r_2$, where $r_1$ and $r_2$ are randomly ...
0
votes
1answer
62 views

GCM implementation

I want to write GCM implementation myself (only for research purposes). So far, I have successfully written CTR implementation (for AES), but now I ran into few problems with GCM. If I'm not wrong, ...
0
votes
1answer
178 views

Symmetric mutual authentication with client using a derived secret

I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
1
vote
1answer
239 views

CBC-MAC: is it secure to authenticate a fixed length ciphertext?

Suppose I have a fixed-length arbitrary ciphertext. To authenticate such ciphertext: I generate a random AES Key $K_{auth}$. Then I compute the CBC-MAC Tag of the ciphertext with $K_{auth}$. ...
1
vote
1answer
166 views

Additional Data in AEAD (Chacha20-poly1305 libsodium)

I have recently been playing with Chacha20-Poly1305 with libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell ...
0
votes
1answer
58 views

Why should I use X.509 Authentication over PKC based Authentication?

So I have two examples and I don't understand why one would be chosen over the other. Example 1. A sends EPUb[r1] to B (asks B to prove knowledge of ...
1
vote
0answers
76 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
16
votes
3answers
3k views

Specification of the Megamos crypto algorithm

It has recently emerged that a paper that was scheduled to appear at Usenix Security 2013, titled "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobiliser", has been censored ...
0
votes
0answers
42 views

Modifying algebraic secrecy message to use digital certificates

I have the following message: sign((M’, T$_A$, sign((encrypt((encrypt(M, $K_{pbB}$), M’), K), T$_B$), $K_{sB}$)), $K_{sA}$) Sign is used for signature generation. Encrypt is used for ...
1
vote
1answer
103 views

Attacker in a key exchange

I'm having trouble with the following question: $X(A) \rightarrow B:(A,N_X)$ $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$ $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$ ...
4
votes
2answers
1k views

Can a salt for a password hash be public?

For my understanding salts in password hashes are used to prevent the precomputation of $plaintext \to hashvalues$ (rainbow tables). I know from different threads, it is not necessary to keep the ...
3
votes
2answers
117 views

Memory-expensive hash from an array of hashes?

Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking? What I have in mind myself is this: We have an input $X$, we ...
1
vote
1answer
86 views

Retrieve timestamp from TOTP value

TOTP (Time-based One-Time Password) as I understand is an algorithm that uses the current time as a variable along with a shared key to generate a secured token. Wiki page for reference: ...
3
votes
3answers
175 views

Zero Knowledge Example using discrete log

I've been exploring Zero Knowledge Proofs and while the classic cave example by Jean-Jacques Quisquater makes sense, I find the discrete log example problematic. Since the Verifier is given p, g and ...
1
vote
0answers
29 views

Pros and cons between HOTP and TOTP [duplicate]

I'm reading the RFC6238 (TOTP) and RFC4226 (HOTP) standards and can't get which one is to prefer? I've searched around a bit and it seems like TOTP is the one that is most used, but some argue that ...
0
votes
1answer
65 views

Client-server communication

The base scenario goes as follows: A program stores some user's confidential data encrypted on their disk. The user is most probably clueless and the disk might get stolen, but these are the classical ...
0
votes
1answer
64 views

Efficiently show/prove knowledge of third party secret without leaking information

Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob. Bob then publishes some data $d$ (his identity or a message or smt.) and an ...
0
votes
1answer
54 views

Detect desynchronization in HOTP authentication [duplicate]

In HOTP authentication, is there a way for a system to detect that the token has been desynchronized? If so how does it know that the OTP was generated from a desynchronized (but valid) token and is ...
1
vote
1answer
126 views

Chess Grandmaster Problem and “Valid” Attacks on Zero-Knowledge Proofs of Identity

A long question here, but I really want to motivate why I'm confused. Consider the following attack on the Schnorr Identification Scheme. Alice chooses a random $k$, computes $\gamma = \alpha^k ...
1
vote
1answer
98 views

Is it possible to 'fake' time for TOTP? (Time-based One-time Password)

TOTP (Time-based One-Time Password) Algorithm is used in Two factor authentication. I understand the algorithm and that current time is used as a variable to generate a token. Wiki page for reference: ...
2
votes
1answer
74 views

Can adding nonces make challenge response authentications weaker?

In a custom protocol we want to replace an aged tiger32 based challenge response authentication. I suggested that we use something existing, so threw HMAC into the room. As per wikipedia it works as: ...
2
votes
2answers
234 views

Skein or Keccak stream cipher construction

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: $H$ = Keccak or Skein hash with a 256 bit output $K$ = The main 256 bit random key, ...
5
votes
1answer
157 views

Is SRP post-quantum secure?

Is SRP-6a post-quantum secure? If it is not post-quantum secure, do any post-quantum secure alternatives similar to SRP-6a exist?
1
vote
1answer
61 views

Deprecation of RSA-SHA-1 in DKIM keys?

I recently noticed that OpenDKIM on my mail server is objecting to DKIM signatures from a client, saying their key is insecure. It may be that that's due to lack of secure DNS (confirmation anyone?) ...
4
votes
3answers
2k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
4
votes
1answer
85 views

Authenticating Very Short (Sub-Block) Data

If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)? ...
1
vote
1answer
62 views

Verifying signature owner (without verifying the actual document)

Programming in Java. I have an RSA key-pair, a document, and a signature created with the Java Signature class, using SHA512WithRSA. In order to verify the signature, of course, I need to provide the ...
2
votes
0answers
65 views

Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks?

As the question suggests, I wanted to get a sanity-check on this issue... is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay ...
3
votes
2answers
390 views

AES-ECB as an authentication mechanism

ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication? Assume A wants to transmit an ...
0
votes
1answer
55 views

How to make a document truly read only

How is it possibile to cryptographically make a document truly read only? As in read only I imply that the user can obviously view it which can be achieved by coding which pixels have which colors. ...
3
votes
0answers
66 views

Managing data permissions/access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how is it possible to share access of encrypted data with N entities, and be able to ...
3
votes
2answers
196 views

Attacking unuauthenticated RSA

In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice ...
4
votes
3answers
972 views

How to perform authentication without central server in P2P?

How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority? ...
2
votes
1answer
59 views

Constant data as input to hash

I want to use hash function on some data, and part of this data, might be constant for a certain period. The output of the hash function is used as authentication data (MAC). I want to know if there ...
2
votes
1answer
63 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
2
votes
0answers
192 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
8
votes
2answers
380 views

What current authenticated key exchange standards exist?

If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended? Many protocols have ...
8
votes
2answers
2k views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
4
votes
1answer
191 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
2
votes
2answers
1k views

Digital Signature using symmetric key cryptography

Generally digital signature is a public key cryptography concept.But it needs high overhead. So is there any publication or link available where 'digital signature using symmetric key' has been ...
4
votes
1answer
473 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
2
votes
1answer
124 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...
4
votes
2answers
181 views

Spoofing protocol nonce

Amy and Betty have a shared key $k$, and the protocol below is to provide a mutual authentication for both Betty and Amy. A sends B : $n_a$ B sends A : $n_b \;\|\; E(k, n_a)$ A sends B : $E(k, n_b)$ ...
6
votes
4answers
194 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
1
vote
1answer
85 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
2
votes
1answer
39 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
4
votes
2answers
182 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...