11 reputation
2
bio website
location
age
visits member for 9 months
seen Jan 17 at 22:07

Jan
17
comment Is this new server API authentication protocol secure?
@CodesInChaos, I agree with your last two sentences. However I want the scheme to be secure against theoretical quantum computers and I'm not sure average public key cryptography will protect against that - especially if the scheme is relying on the discrete log or integer factorization problem for security. My hash based approach should be secure against a quantum computer.
Jan
17
comment Is this new server API authentication protocol secure?
Thank you for the effort of thinking and writing that up K.G. Would you say your solution is secure from theoretical quantum computers seeing it is using DH generator? That was one design goal I had in mind with this protocol. Is there a particular issue with the way I did it? That is, the user creates a private key based off the shared key and a random nonce, then sending the nonce and the server recreates the user's private key on its end using the same process and stores it in the database. An attacker can see the random nonce by intercepting traffic, but without the shared key it's no use.
Jan
17
comment Is this new server API authentication protocol secure?
@CodesInChaos I removed the unnecessary usages of the shared key. Now it's only used in the account creation process. Everything else should use the user's private key. Do you still have an issue with it?
Jan
17
revised Is this new server API authentication protocol secure?
Updated protocol so the shared key is only used for account creation.
Nov
26
awarded  Student
Nov
26
revised Is this new server API authentication protocol secure?
added 173 characters in body
Nov
26
comment Is this new server API authentication protocol secure?
@CodesInChaos What I'm trying to do is have a secure protocol against active MitM attacks. The best way to do that AFAIK is to have a secret key on the server and the client per user. How do you get a client to create a key on the server while avoiding active MitM attack? The admin could create a key on the server for each client and give it to each client but that's time consuming. What I am trying to do is have a 'shared key' where only a few clients know that key. Then each user key can be created on the server and that shared key be used to verify it is legitimate. What is a better way?
Nov
26
comment Is this new server API authentication protocol secure?
@CodesInChaos It's quite difficult to just use SSL for true security. If the NSA/GHCQ etc have servers set up to automatically perform a MitM attack on SSL then that's their easiest option. Much easier than stealing the shared key which would require a targeted attack on the server or one of the clients.
Nov
26
comment Is this new server API authentication protocol secure?
@CodesInChaos as part of the 'message packet' the protocol says which API action is to be performed. Therefore if they change which API action the server will reject the request. That should cover off that concern, yes? How you would go about ensuring SSL is not MitMed? From what I understand each user would need the public key transfered to them in person and not over the internet. This is doable however anyone can still send API requests to the server and they will be accepted. I still need a way to authenticate each user.
Nov
25
comment Is this new server API authentication protocol secure?
Hi @CodesInChaos yes it can and may run with SSL as well to provide an extra layer of security. However the protocol needs to stand up on its own in case the SSL is MITM'd by a powerful adversary intercepting and actively attacking the communications. The API credentials need to be protected so that adversary can't use them to damage the data on the server. The "message packet" is encrypted and signed with another method not described here using user to user (end-to-end) encryption. I'm just after an analysis of this server API authentication protocol where users will store data on the server.
Nov
25
comment Is this new server API authentication protocol secure?
Sorry @Ricky that should be HMAC-256(shared key + private key, username + nonce). Any suggestions for improvement or problems you can see?
Nov
25
revised Is this new server API authentication protocol secure?
added 1 characters in body
Nov
24
awarded  Editor
Nov
24
revised Is this new server API authentication protocol secure?
added 39 characters in body
Nov
24
comment Is this new server API authentication protocol secure?
Hi @Ricky, it will just use 2 arguments because "+" represents concatenation. For Hash(Key, Message) I have separated what goes into the key and what goes into the message with a comma. I should have put that in the question.
Nov
24
asked Is this new server API authentication protocol secure?