1
$\begingroup$

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private key remains only known to the listener so that it can decrypt the data. The problem in this scenario is that, the eavesdropper can eavesdrop on the Public Key and send "Falsified" data to the listener. In an abstract level, I know that this problem can be solved by making use of DSA to authorize the parties.

In Microsoft .Net Frameworks, the DSACryptoServiceProvider, very much like the RSA, I see that DSA is also a asymmetric algorithm consisting of a public and private key. And I assumed that with different Keys, I will come up with different signatures for the same data. So I also assume that I have to send the public key to the sender of the data for the purpose of verification ( the padlock concept). But in this case it will not work for the reason I explained.

My question is that, how do I have to use the DSA to assure that the stream is coming from the authorized party.

$\endgroup$
1
$\begingroup$

If I'm understanding things correctly, you want to make sure that the public key you receive actually belongs to the person you want to communicate with.

Thus you want to avoid MITM attacks, which is non-easy. Standard (TLS/S/MIME/...) solution would be to create a certificate signed by someone you trust to assure you that the particular public key belongs to the entity you expect.

Another solution would be to exchange some data over a second (trusted) channel containing a hash of the public key assuring you that the key belongs to this person. It is sufficient to do this once for the life-time of a key.

The last method of defense I'm aware of is identity-based systems or implicitly-signed systems. This is highly complex and I'd rather go with certificates in large scale and with second channel in smale-scale.

$\endgroup$
  • $\begingroup$ The problem is whatever the Trusted data is (Either a certificate or a public key), they can stolen when communicated and abused. Let's say over a secure channel, Alice request a public key from bob, and bob sends Alice the key. The third party can also get the public key and send bob falsified data. If using DSA the hash of the data must be available to bob beforehand which is not possible. $\endgroup$ – Transcendent Apr 6 '15 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.