432 reputation
310
bio website
location
age
visits member for 2 years, 8 months
seen Mar 23 at 9:17

Aug
18
comment Is public-key cryptography the only option in this scenario?
I have edit the question to clear any confusion, I apologize for the unclarity.
Aug
18
comment Is public-key cryptography the only option in this scenario?
I have edit the question to clear any confusion, I apologize for the unclarity.
Aug
18
revised Is public-key cryptography the only option in this scenario?
added 1652 characters in body
Aug
18
asked Is public-key cryptography the only option in this scenario?
Aug
3
comment ID-Secret Scheme
For the first update, HMAC(secret, ID) is used so that an attacker cannot find the ID (which I'm trying to keep secret). In other words HMAC(secret, ID) is used as an identification token if you will... The second part of the message (the ciphertext) carries the authentication request. Each ID has a corresponding SECRET to Party 2, so Party 2 needs to: see if HMAC(secret, ID) exists, and if so check if the ciphertext can be decrypted with the corresponding SECRET. For the second update, as the result of the ciphertext can be validated, there is no need for a message MAC.
Aug
3
comment ID-Secret Scheme
SECRET is the key, ID is the message on the HMAC. Perhaps I didn't make clear that the HMAC only serves as an identification method to Party 2 without revealing the actual ID or SECRET (the values I'm trying to hide). Why will it be better to include a MAC of the ciphertext? The ciphertext is encrypted and as such one needs the SECRET (key) to successfully change the underlying input. If an attacker tries to change the ciphertext (without knowing the key), the intended recipient of the message will run into an error decrypting the ciphertext, or the underlying message will fail to be validated
Aug
3
comment ID-Secret Scheme
@Paul Crowley My aim is to authenticate a user successfully without revealing either the ID or the SECRET. I am fairly certain it is secure as it it, I'm just asking if there are any attacks (theoretical or practical) which reveal the values I'm trying to keep hidden.
Aug
3
awarded  Student
Aug
3
asked ID-Secret Scheme