Hot answers tagged

6

Even after your updates, the first part seems unnecessary. However, steps 4-5 do indeed prevent the attacker from learning future nonces they could ask the key MAC values for. So the protocol steps 4-7 would be secure with a secure MAC. I agree with CodesInChaos that using HMAC would be better, because H(m||k) has some weaknesses, while HMAC is standard. ...


2

Here is a small scheme how this works : Server Client | | | r,n | S: Find s such as HMAC(s,r) = xxxx0000 | ==========> | | | C: *compute HMAC(0,r) = 123456789* | | C: *compute HMAC(1,r) = 124687946* | | C: *compute HMAC(2,r) = 164946518* | | C:...


1

No, there are no problems (which I could see) with re-using the signature key in this scenario. There are two potential concerns: It may be possible to learn something about the private key using the challenge-response protocol It may be possible to re-use the signature of a run of the challenge-response protocol for TLS The first concern is clearly ...


1

From your question, I believe that what you are looking for is a proof of storage. I will point you in the direction of one paper, and you can use that to look for other work on the topic.


1

Neither scheme, as described, is secure against man-in-the-middle attacks. In particular, an attacker who wants to impersonate the client can simply relay the server's challenge to the real client, pretending to be the server, and then relay the real client's reply to the server. After that, they're free to keep pretending to be the client. However, ...


1

As long as properly implemented using secure algorithms, there is no real security difference. In both cases the protocol is secure as long as the underlying signature or encryption algorithm is. However, one difference is the random number used: In scheme A the numbers must be unique. If the server ever reuses a number, then an adversary could replay a ...



Only top voted, non community-wiki answers of a minimum length are eligible