# Tag Info

## New answers tagged authentication

0

It is hard to tell exactly what you are asking, but it seems like you are looking for a basic understanding of how authenticator tokens work. See below: https://www.youtube.com/watch?v=k_zpbJF9pmc https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc4226

3

From RFC 4880 - Open PGP Message Format (emphasis added) OpenPGP implementations SHOULD compress the message after applying the signature but before encryption. As the signature provides authentication, and you specifically ask about authentication, I think that quote from the RFC should answer your question. Compression does not affect ...

3

Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified in transit/on storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes ...

0

To keep it simple: authentication = something to indicate the origin and authenticity of a document or message. signature = a form of identification in authorizing a document or message. You can authenticate a document/message by “signing” it with a signature, or you can authenticate a document/message by authenticating the document/message itself (using ...

1

With authentication, only the intended recipient can confirm the authenticity of the message. With signatures, everyone can.

2

You sign a document with a signature. You authenticate a signature (thus proving the authenticity of the document).

1

Seems like the answer is that your goal is obviously impossible, without Bob's cooperation. How would Alice distinguish between (1) a write to the disk by Bob's PC, initiated at Bob's request, vs (2) a write to the disk by Bob's PC, initiated by the malware? She can't. They look identical from Alice's perspective. For instance, having Bob's PC sign ...

1

Yes. $\:$ Since "Eva sees everything written on Bob's PC", the process needs to involve something that's not written on Bob's PC. $\:$ They could use either some sort-of MAC that can be computed with pencil-and paper, or a signature scheme whose private key is held on a hardware token. I don't have any particular such MACs in mind, although my immediate ...

0

Add to the list FHMQV (probably covered by MQV and HMQV patents), and SM2 (Chinese standard for authenticated key agreement, patented by Chinese government, IPR terms unclear). I personally would probably use FHMQV (permissions/licensing issues aside). It is highly recommended to avoid trying to design your own. If you cannot use any of the existing ...

0

What about SRP? It has an additional property, that you do not need to keep the shared secret unprotected on the server. http://srp.stanford.edu/design.html You did not specify if you want to restrict the number of roundtrips, but I guess with SRP they can be minimized.

Top 50 recent answers are included