# Tag Info

0

You mention OpenSSH format, so may I assume you can use OpenSSH as part of your solution? If so, how about just using RSA key pairs with an authorized_key file? Example The server only ever has a public key for each user stored on it (nothing to lose to a server compromise) and the client just does RSA authentication (no passwords ever sent - client keeps ...

2

I can see some weaknesses in your protocol. For example, it allows any attacker to request the encrypted private key and thus mount an offline dictionary or brute force attack on the password. (An incorrect password doesn't give you a properly formatted OpenSSH key.) Thus this is a good idea: I'd rather use something proven. As mentioned in the ...

2

Both the AES key size and the RSA key size matter, because it's no use adding security beyond the weakest link. Here the weakest link is 2048-bit RSA, which is considered roughly equivalent in security to 100-128-bit symmetric keys (depending on who you ask). So having a password with much more than 100 bits of entropy would be fairly useless. In practice, ...

3

Ignore the integer overflow issue I mentioned in a comment, for a moment. I don't see how this adds any security. For all $n>2$, the function you are calling Fibonacci is one-to-one, and since $n<256$, you could easily build a lookup table without much memory to invert the function. Therefore, to break this, all one has to do is invert the Fibonacci ...

0

Is this approach (deriving a password from a signature) cryptographically sound? Not in general. There are signature algorithms that are completely deterministic and signature algorithms that aren't. With the latter kind you would be unable to reproduce the password later. With a deterministic algorithm, yes, the basic idea of using the signature as a ...

Top 50 recent answers are included