# Tag Info

Sysadmins have switched from one password hash algorithm to another many times. There is a standard process for this switch. The Modular Crypt Format (MCF) is the standard scheme for formatting encrypted passwords, as used by passwd, crypt, etc. (see Why are there $signs in my passwd file? ). MCF uses a single column to store the password hash algorithm ... 6 The GQ identification scheme is essentially a zero-knowledge proof of a value$x$such that$x^\mu \equiv J \pmod N$where$N$is an RSA modulus and$(\mu,N)$are system parameters and$J$is known to the verifier and$x$only known to the prover. Now your question is not directly concerned with the aforementioned proof where a user shows the possession of ... 6 A is acting as a square-root oracle in that protocol. We can use that oracle to factor$n$and break the scheme. Suppose you are an attacker that wants to impersonate A. You: Pick a random$m$; Send$m^2$to A; Compute$p = \gcd(m_1 - m, n)$, thus factoring$n$. This works with probability$1/2$for each attempt. 5 The protocol's description includes "Alice then encrypts$R_B$with her private key". This has no standard meaning. Comments have clarified it is used an "RSA encryption scheme with proper padding" and I am taking as granted that encryption of$R_B$using the private key half of$K_A$, denoted$K_A^-(R_B)$, is obtained by padding$R_B$as in encryption, then ... 5 Yes, this looks fine. I assume$A$and$B_i$are trusted parties. The protocol as I understand it looks like this:$A$,$B_1$,…,$B_n$agree on a secret key k.$A$broadcasts messages ($m_1$,MAC($m_1$,$k$)), … , ($m_j$,MAC($m_j$,$k$) which$B_1$,…,$B_n$receive and authenticate. I assume$A$and$B_i$are trusted parties, so no$B_i$will itself ... 5 Digital signatures are used to solve this type of problem. That is, a way for$A$to sign the message for$B$so that$B$is highly confident that$A$signed the message in question. There are lots of signature schemes out there, such as RSA signing, DSA, and others. A MAC is not strictly a digital signature, but has a subset of that functionality and may ... 5 As cybergibbons notes in his answer, the court decision itself is quite interesting reading. In particular, while the details of the "Megamos algorithm" itself are obviously not given in the court decision, the manner in which it is used is described in a surprisingly clear manner in paragraphs 4 and 5: "In detail the way this works is as follows: both ... 5 The usual answer is that a salt can be make public; if that was a problem, then the salt would not be called a "salt" but a "key". In some protocols, unauthenticated obtention of the salt is the norm, and is not considered to be a problem. E.g. with SRP, a password-authenticated key exchange, where any salting and hashing must necessarily occur client-side. ... 5 Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified during transmission and/or upon storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message ... 4 Start by naming the current password type (perhaps 3des-cfb) and storing that value on each record as an additional column in the database. You can now start updating existing records. Enumerate over the values in reasonably sized chunks and hash them securely. bcrypt is a good choice. Store the bcrypted value in the database and change the password type ... 4 An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher. Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination. Essentially these xor a key-stream into the message to encrypt it ... 4 “Does anyone know what the Megamos algorithm is?” Yes. According to http://www.bicotech.com/doc/megamos_cr.pdf (PDF) — which provides the best description from my point of view — the Megamos crypto is: MEGAMOS CRYPTO Read-Write High Security Device - Memory organisation Description The MC is a high security Read-Write RFID Transponder. A ... 4 Yes, there are several ways in which Mallory could pretend to be Amy. One obvious way, which doesn't even involve Amy herself in any way, would be for Mallory to perform steps 1 and 2 of the protocol normally, as if he were Amy. Then, given Betty's nonce$n_b$, Mallory can start a second, parallel instance of the protocol, again pretending to be Amy, and ... 4 Google (and other companies) have decided to enable one-time passwords for their 2-factor authentication as a step to improve password security. Here is the webpage that explains what Google is doing in more detail (including source code): https://code.google.com/p/google-authenticator/ In a nutshell, they implement two IETF RFCs, namely RFC 6238 and RFC ... 4 That was a bad edit to Wikipedia. The phrase "Carry-forward verification" is not a standard, well-known term in the cryptographic literature. It should not have been included in Wikipedia without a reference to something more specific. But oh well, no one is perfect, sometimes these things happen. Your request for an elaborate survey of MITM defence is ... 4 For P2P authentication, you can go for web of trust concept. Simply this means, if someone is trusted by people you can trust, you can also trust that unknown person. In OpenPGP, a certificate can be signed by other users who trust the association of that public key with the person or entity listed in the certificate. So trust relationships can be ... 4 You may be interested in something like the Cryptographically Generated Address (CGA) from RFC 3972. CGA is used in Secure Neighbor Discovery Protocol (SEND) of RFC 3971 to bind a public key to an IPv6 address. The basic idea of CGA is to generate part of the IPv6 address by computing a cryptographic hash over the public key. The corresponding private key ... 4 Because$r$is not guaranteed to be a Quadratic Residue, so for random$r$there wouldn't be$m_1$such that$r \equiv m_1^2(\mod n)$, therefore authentication will be impossible in this case. 4 No. Cryptography alone cannot solve this problem. Solving this problem requires a combination of technical (e.g., cryptography, systems security) and non-technical (e.g., legal, regulatory, contractual) solutions. Even the technical part is not solely a cryptography question; it as much about systems security. 3 I think the solution to your problem is a digital signature as CodesInChaos pointed out. Here is how it would work: When a user registers with your server they are given a token which will consist of (at a minimum) the user's id. The server also uses its private key to digitally sign the token (or more likely a hash of the token). Now, say user1 and user2 ... 3 It is important to consider the model in which security is proved. In this case, the attack proceeds in two phases: first a phase where the adversary as a verifier interacts with the honest prover, then a phase where the adversary as a prover interacts with an honest verifier. The adversary wins if the honest prover accepts. The paper proves, under ... 3 Since you do not describe why TLS Handshake and IKE are appropriate in your situation, and as long as you don't describe your situation, it's hard to really help you. Also, you haven't stated if it's only IKE that's not appropriate, or if that also includes IKEv2 (which improved the IKE protocol). Therefore, I'll simply assume you meant both. As an ... 3 Yes, because Mallory can use Amy and Betty to get any encrypted nonce; Amy and Betty are oracles for Mallory. She just has to send the nonce she has to encrypt to either one of them and they perform the task for her (in another "authentication attempt", using step 1 & 2). Usually you protect against this kind of situation by performing an encryption ... 3 HMAC-SHA-256 is sufficient for up to 256 bit security. Confer e.g. NIST SP 800-107. This recommendation is based on the premise that collision attacks are infeasible against common uses of HMAC, and that you consequently only have to worry about primary pre-image attacks that attempt to recover the secret key (and use this for forging subsequent messages). ... 3 "The problem I face is that all authentication protocols require some kind of shared secret between the devices and the server." Similarly, the problem I face is that$\:1 = 0 \;\;$. Since your post includes "(eg: a digital signature of a random string by the server)", I will assume that the server has a signature key-pair and the devices alrady know ... 3 The Wikipedia article points out a good reason for using a random challenge value: preventing replay attacks. If the hash was always the same (as the hash of the symmetric key would be), then having listened in on one challenge-response cycle, a malicious listener could pass further handshake tests. 3 In addition to the earlier remarks about the missing background of your question please also consider that TLS and IKEv2 are actually not just a single authentication and key exchange protocol but rather a framework that supports many different AKA protocols. Let us use TLS as an example. In TLS you have the concept of ciphersuites and they allow you to ... 3 The probability of such a "collision" occurring randomly, with honestly-generated RSA keys, is extremely low. Mathematically justifying that assertion can be tiresome, but the idea is the following: Let$s$be a RSA signature, i.e. an integer of size$k$bits for some$k$(e.g.$k = 2048$). We consider RSA keys$(n,e)$where$n$is the modulus (of size$k\$ ...