New answers tagged

1

Public key encryption uses a public key of the receiver; anybody can encrypt. So origin authentication would only work if you'd also have a shared secret key (in which case the whole public key encryption becomes kind of useless) or a private key (in which case you'd probably use a signature or an authenticated key agreement protocol).


8

Can anyone explain why CBC-MAC is not secure for variable length message? For the previous question I'll quote Matthew Green's post from 2013: A quick reminder. CBC-MAC is very similar to the classic CBC mode for encryption, with a few major differences. First, the Initialization Vector (IV) is a fixed value, usually zero. Second, CBC-MAC only ...


0

Every 10 min S1 publish the hash value of PS+the current time which is used as public identifier (PI). Every one can see the value of PI in the internet. As S2 has the value of PS, he also use MD5 to get the hash value of PS+the current time and compare it to the value published by S1 and therefore identify that the value provide from S1. Essentially, ...


2

I am trying to better understand authentication. Lets say I have posted my 128-bit AES symmetric key on some forum, encrypted asymmetrically to my friend using 256-bit ECC (25519). The forum isn't controlled by us so this key message could potentially be tampered with. Well first of all, note that encrypting with curve25519 isn't as trivial as ...


1

If the key is send beforehand it is not required but highly recommended to sign it. Otherwise anybody could post an AES key, encrypted using the public encryption key of your friend. In that case your friend may only find out after receiving the right messages. Furthermore, your friend may not be able to distinguish between an invalid key and an invalid ...


0

Is it safe to generate IV along with KEY from PBKDF2 when using and storing salt for each user or should IV also be randomly generated and stored along with salt? When generating IV from PBKDF2 I'm basically choosing for it to be part of the key, ie a secret. Using a sufficiently large salt per user would guarantee that no two generated KEY/IV pairs ...


0

Can you please describe your functional requirements in more detail, i.e. what are you trying to solve? That will ensure that you get most appropriate advice. What do you care to achieve? server to authenticate the client making the reservation? a way for the client to send its driver license in a confidential manner? client to authenticate the server ...



Top 50 recent answers are included