# Tag Info

1

I think my definition of 'simple' is different from yours. : ) Are there any evident attacks on it? It's vulnerable to man-in-the-middle attacks, like: Step 9: M replaces $\langle b_{U}, v'_{U}, h'_{U} \rangle$ with $\langle b_{U}, v_{M}, h_{M} \rangle$, where they've calculated their own random bit string and used their own key to encrypt it. Now M ...

1

I have figured out a way to use TLS with only a EC key by using DSA instead of RSA. I had not realized you could do DSA with a EC key. My mistake was trying to use RSA to sign the certificate. Now I can generate my certificate and self-sign it only with the EC key. The peer will simply check to make sure the certificate was signed by the appropriate node ID ...

0

First, one point. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Therefore, you have PKI, even though "there is no PKI 'authority'". Is this a proper use of ECDH anon, and will a simple challenge/response scheme at the application level guarantee peer authentication? Yes, and No. An ...

3

If you want $N$ serial numbers, your serial numbers will have to use $n$ bits for uniqueness, where $n = \log_2 N$. So if you have 100 bits to use for the serial, you could use 20 to get about a million serials and have 80 bits to use for a cryptographic MAC or signature. Now there are two approaches, the symmetric and the asymmetric. In the symmetric ...

7

What happens if the sender is at another point in the sequence? ... the key is pressed while out of range to the car. In a rolling code (code hopping) system, the keyfob transmitter maintains a synchronization counter C, incremented every time a button is pushed. The car receiver stores the most recent validated synchronization counter it has received ...

3

In a rolling code both the sender and the receiver always move forward in the sequence. If the sender has sent the $n$th code, then it will send the $(n+1)$th next. Contrarily, if the receiver has seen the $n$th code it will only accept the $(n+1)$th code or some later code. What happens if the sender is at another point in the sequence? Think of that ...

2

It'll be the same situation that NY City suffered some days ago: when you have little variability on your data, i.e., they have a fixed-small size, it'll always be fast to brute force. You don't say how long your number is, so I'll assume it can range from 0 - 10,000,000,000 (so, a unique number for each human being on Earth today, plus some spare). You ...

0

You cannot ensure this - at least not against an determined attacker. Depending on the platform the app runs you might get some more assurance (think "TPM with metered boot"), but as soon as the attackers have control over the device they can circumvent it - even when your app is confined in a smartcard or similiar rigidly protected device.

1

I haven't seen much analysis on using ordinary hashes for content authentication. Can anyone can give me a pointer on whether this is safe? With good choice of primitives it is. Public key signatures use a hash function in a similar way to identify the message signed. However, where a MAC only needs what amounts to second preimage resistance, a hash ...

0

Would that scheme be sound to implement ? Are there any flaws that would make it foolish ? I believe it's sound. Note that SRP is a proven authentication protocol that has similar security characteristics. It has more round-trips, though. I guess the most important thing to consider here is whether the salt generation is "random enough" to ...

1

Is there a vastly simpler way? I think so. Let the server send a reset token in the following form: (deadline, HMAC(server key, id_user || S || deadline)) That is, the server calculates an authenticator that allows id_user to change their secret from S before deadline. The key used should be only known by the server and can be changed often, since ...

3

Well, 32 bits is somewhat short, so one could just try ciphertexts. However, there is a much better attack. Choose M0 arbitrarily, let P be the CBC padding for Headers || CRC || M0, and choose M1 so that CRC( M0 || P || M1 ) = CRC(M0). Submit M0 || P || M1 to be encrypted, truncate the ciphertext to the length of encryptions of M0, and then output the ...

0

$\;\;\;$ Probably as long as you compare securely, although you're applying $\;\;\;$ a pbkdf to what should be a uniformly random long secret key. $\;\;\;$ Don't bother computing S'; let S be a uniformly random secret key and use it instead. $\;\;\;$ To construct a reset token for a user U, set h = HMAC(S, 0 || (id,U,e) ), $\;\;\;$ set H = HMAC(S,1||h), ...

5

Yes, there are several ways in which Mallory could pretend to be Amy. One obvious way, which doesn't even involve Amy herself in any way, would be for Mallory to perform steps 1 and 2 of the protocol normally, as if he were Amy. Then, given Betty's nonce $n_b$, Mallory can start a second, parallel instance of the protocol, again pretending to be Amy, and ...

3

Yes, because Mallory can use Amy and Betty to get any encrypted nonce; Amy and Betty are oracles for Mallory. She just has to send the nonce she has to encrypt to either one of them and they perform the task for her (in another "authentication attempt", using step 1 & 2). Usually you protect against this kind of situation by performing an encryption ...

3

HMAC-SHA-256 is sufficient for up to 256 bit security. Confer e.g. NIST SP 800-107. This recommendation is based on the premise that collision attacks are infeasible against common uses of HMAC, and that you consequently only have to worry about primary pre-image attacks that attempt to recover the secret key (and use this for forging subsequent messages). ...

1

Such keys are called static keys. Keys that are newly generated each time are called ephemeral keys. Note that you need to trust the public keys of the key pairs to use them for authentication. Please note that there is an issue if you use static keys only for plain Diffie-Hellman: the generated secret will be static as well, as the whole scheme has now ...

2

Yes, the same keypairs can be used to derive shared secrets between multiple pairs of parties. If knowing the shared secret between Alice and Bob would help Eve find out the shared secret between Alice and Carol, Eve could just create her own random private key and calculate a "shared" secret between that key and Alice's public key to get the same ...

1

I'd suggest that you clearly define which kind of Bluetooth device you are using, more specifically what its capabilities are with respect to processing power, etc. Another question, can you enter a number on a bluetooth device (e.g., for a PIN-based authentication, for example)? From what you're writing, I'd assume that RSA won't be a plausible solution, ...

2

Well, hope that it's not late for this answer. Because it was yesterday that I encountered this problem and I'm new to this wonderful website. According to your description, and as far as I know, this protocol meets your demands very well. First, it works with RSA as you have mentioned in the second paragraph. The original version of this protocol is ...

Top 50 recent answers are included