Timeline for Is this ECDHE approach secure?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 12, 2016 at 19:45 | comment | added | Maarten Bodewes♦ | @frarugi87 I'm still contemplating other attacks, but when you've established the encryption key with a man-in-the-middle then signing a message won't disallow decryption of the message. Especially if you only have one way communication after the handshake, an attacker can simply decrypt everything. That the message is also signed doesn't deter any attack. | |
| Jul 12, 2016 at 12:11 | comment | added | frarugi87 | Thank you for this answer. You really made me think about lots of things. Anyway, I have just a couple more questions (you know, the more you learn, the more you understand how much you don't know). As for point 1, probably I'll remove the ephemeral feature and use static key, shared "physically" (i.e. manually copied). And I'll move to an authenticated mode (probably CCM or EAX). Communication will be only client -> server, so just one keypair per side is enough. I just did not understant completely point 2, even if with an authenticated mode the signing is not needed anymore | |
| Jul 12, 2016 at 11:09 | comment | added | Maarten Bodewes♦ | Thanks for the accept. I generally tend to wait a while before accepting answers though. Answered questions receive less views and there may be better answers or comments available from people that haven't had the time to view the question in the first place. I usually wait some 18 to 24 hours so that other timezones have the ability to chime in. | |
| Jul 12, 2016 at 10:51 | vote | accept | frarugi87 | ||
| Jul 12, 2016 at 9:52 | history | answered | Maarten Bodewes♦ | CC BY-SA 3.0 |