network profile
| bio | website | |
|---|---|---|
| location | Troy, NY | |
| age | 28 | |
| visits | member for | 5 months |
| seen | Feb 20 at 20:45 | |
| stats | profile views | 1 |
|
Dec 10 |
awarded | Editor |
|
Dec 10 |
revised |
Can I use PGP to sign a message without providing cryptographic non-repudation? Updated to clarify on a concern raised in comments |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @DChest - I'd classify DH as asymmetric, but any part of DH mutually attests to the sender and recipient. The only thing DH provides that isn't non-repudiative is the shared key which is used by a symmetric algorithm. I do think I see where you are coming from though if you assumed I was taking a looser definition of asymmetric vs symmetric. I have updated my answer to provide further clarification on this point. Thanks. |
|
Dec 10 |
awarded | Teacher |
|
Dec 10 |
awarded | Supporter |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @Flimm - Incorrect. The only thing that can be non-repudiated is the providing of the shared key. A third party can not tell if the sender or the receiver performed the symmetric encryption since it is not reliant on any secret of the sender. In other terms, it only proves that sender talked to recipient at some time. |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @Flimm - put more briefly, Encrypt (public_key, symmetric_key) is incomplete. It is Encrypt(public_key, Sign(private_key, symmetric_key)). Thus all that can be proven directionally is that sender sent a key to recipient. |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @Flimm - The symmetric key is signed by the private key of the sender. You are talking about wanting a key exchange in your question. If you limit your asymmetric cryptographic operations to only the key exchange, then the payload can not be proven to be from either party since the only encryption on the information was exposed to both parties. Since the key exchange was signed by the sender and encrypted to the receiver's public key, no third party can have access to the shared secret key. |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @dchest - What is possible is to exchange messages via asymmetric cryptography that allow for the secure establishment of a shared key. Anything that is shared on that shared key will then be known to be between those two parties, but the originator can not be proven as both parties have the shared secret. |
|
Dec 10 |
comment |
Can I use PGP to sign a message without providing cryptographic non-repudation? @dchest - Diffie Hellman key exchange is not using Asymmetric crypto to provide the service I was talking about, it was providing an agreed upon symmetric key which can then be used by both parties to exchange data. By definition, asymmetric cryptography means that only the private key holder can decrypt information encrypted with the public key and only the holder of the private key could encrypt data such that it is decryptable by the public key. Thus, it is not possible for the receiver to produce an asymmetric validation that they could have been the sender as they lack the private key. |
|
Dec 10 |
answered | Can I use PGP to sign a message without providing cryptographic non-repudation? |
