Authentication is successfully validating that an entity you are communicating with is actually who they claim to be. The entity typically demonstrates who they are by showing they possess a secret that only they could know.

learn more… | top users | synonyms

1
vote
0answers
168 views

Is TOTP or a timestamp encryption a better timestamp-based authentication token system?

Are there advantages to using TOTP over encrypting a timestamp with a shared secret, in cases where the readability or ease of typing the token are not important?
6
votes
2answers
2k views

Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?

I need a method to authenticate a process with another in order to establish interprocess communication between them, to prevent malicious processes from trying to hook onto the system. Currently I ...
2
votes
1answer
255 views

Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
6
votes
3answers
459 views

How to authenticate over open channel?

I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
4
votes
3answers
466 views

Can I use PBKDF2 for authentication and decryption?

I want to store a hash for authenticating a password. I also want to use the same password for decryption. Can I use PBKDF2 for both? (I plan to use different salts for the authentication and the ...
6
votes
1answer
337 views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
7
votes
3answers
666 views

Is this a secure implementation of password reset email?

I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are: Expired Tamper Resistant Single Use ...
10
votes
2answers
7k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
1
vote
0answers
123 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
4
votes
1answer
588 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
1
vote
2answers
313 views

How to generate successive stream-cipher keys?

I've identified a weakness in a distributed simulation system I'm looking at, and I'm looking for some advice on how to fix it. Clients initially negotiate an authentication token with a login server ...
4
votes
2answers
328 views

X.509 CSR: Why does CA remove signature?

I just read this article on Wikipedia: Certificate Signing Request I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator. ...
17
votes
6answers
299 views

advances in usability for cryptography/authentication

I'm wondering if there have been any recent advances (say, the past 5-10 years) in human usability for cryptography and/or authentication? By that I mean something that makes it easier for an ...
7
votes
2answers
2k views

What advantage does facebook's new encrypted access_token have?

When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation. ...
3
votes
2answers
147 views

Helper data authentication in PUFs

As I understand, PUFs work by using two procedures: generation and reproduction. Generation reads a value $w$ from a fuzzy source and generates a key $R$ and helper data $P$. Then, in the reproduction ...
1
vote
1answer
131 views

How is the password sent across for verification?

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel. ...
5
votes
1answer
807 views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
5
votes
1answer
270 views

Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?

Section 8, Security considerations, of RFC3526, which defines groups used for Diffie-Hellman has a table recommending some random exponent sizes. In particular, it says: The strength of a key ...
2
votes
1answer
441 views

Hash or encryption function for challenge-response protocol?

Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ...
5
votes
1answer
647 views

What is the proper way to use a client nonce?

I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure: Client's Site (CS) requests nonce from My App (MA), posting their username MA verifies the ...
5
votes
1answer
902 views

How can I encrypt + authenticate short strings into similar short ciphertexts?

I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ...
2
votes
1answer
153 views

Signature scheme with two private keys, neither derivable from the other

Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ...
4
votes
1answer
312 views

Need an introduction to SPKI (or “SPKI for dummies”)

I am familiar with concepts such as the following: PKI and CAs ID based cryptography Certificateless cryptography PGP web of trust more or less anything in basic Crypto that is taught in a college ...
6
votes
3answers
2k views

SHA1 usage for passwords, alternatives and advantages?

My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to ...
2
votes
1answer
129 views

How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
4
votes
3answers
152 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
8
votes
2answers
772 views

How should I store passwords that need to be available in plain text?

Suppose I need to store login information for a third-party website for a few users, how would I go about doing it? Since I am logging into a third party website, I need the password in plain-text, ...