New answers tagged

6

Yes, the basic idea of hardcoding a public key is secure. It is sometimes recommended as an alternative to the complexity TLS and PKI bring – otherwise it can be easy to skip a crucial step and end up with little or no security. However, the "encrypt a secret for server" scheme has some weaknesses compared to TLS. The clearest is lack of forward secrecy ...


1

Short answer: No, it is not vulnerable to man-in-the-middle attacks, assuming that Alice and Bob each have the right signature verification key of the other party. Yet, the man-in-the-middle attack could have taken place at the moment of exchanging the signature verification key. So if $sig_{X}$ is party X's signature key, the attack on the exchange itself ...


1

Here is how it can be Vulnerable. Alice: $x$ Bob $y$ Eve $z$ Alice$\rightarrow$ $g^x$ $\rightarrow$ Eve->$g^z$->Bob Bob$\rightarrow$ $g^y$$\rightarrow$Eve$\rightarrow$ $g^z$$\rightarrow$Alice What Alice thinks key is $g^{(xz)}$ what Bob thinks the key is $g^{(zy)}$ Eve can compute both of these values $(g^x)^z$ and $(g^y)^z$ This is why we need ...


3

It is secure against private key exposure but not against replay attacks by Eve. A three-way protocol avoids this, and doesn't need to use timestamps. The description below is from Delfs and Knebl's book Introduction to Cryptography. Each user, say Alice, has a key pair $(e_A, d_A)$ for encryption and another key pair $(s_A, v_A)$ for digital ...


2

If Eve knows $C, \space N, \space K_{CA}(N)$ then she is able to impersonate $C$ just by following the protocol you described above. If she just knows $K_{CA}(N)$ for a single $N$ then the effectiveness of the attack depends on the set wherein $N$ is picked. But as you are supposing that the communication channel is not secure, an attacker could spy ...


0

If you don't know, original OTR signs only its own $g^x$. The paper here


0

Typical signatures start by hashing the message. Thus including more data in a signature doesn't increase the size of the signature, if the recipient knows what you signed (in this case, remembered what they sent in step 1). You need to hash more data if you include $g^x$, but the cost of hashing a public key is quite low. If you didn't include some kind ...


2

First of all, you should make a more formal definition of the protocol. Security cannot be assessed without a proper definition. Second you don't specify an key sizes. RSA-512 is such a low key size that it may be considered broken. On the other hand, you may run into performance issues if you choose a higher key size (Elliptic Curve crypto would make more ...


1

In the Smart Card industry, it is often used a technique called diversification: individual Smart Cards get a serial number $S$, and a device-unique secret key $K_S$ computed from a Master Key $K$, and $S$, using a (typically: non-entropy-stretching) Key Derivation Function. For example, $K_S=\operatorname{AES-ENC}(K,S)$ where the first parameter of ...



Top 50 recent answers are included