Is it possible to authenticate a client with encryption on a simplex communication channel without the use of authoritative root certs?

  • $\begingroup$ What do you mean by "authenticate a client"? So that the responder can be certain of the sender's identity for all received (signed) messages? What out-of-band mechanisms do you have available to establish authenticity of e.g. a public key or even to transport a secret key? $\endgroup$ – SEJPM Jul 12 '19 at 17:39

Sure. For instance:

  1. Use PKI, register client public key (or self signed certificate) on the server and consider any registered public keys as trusted. You should understand also all drawbacks that it has, like dealing with validity period (how are you going to check if some PKs are still valid / trusted or not and should you remove them from your server PK store or not?), dealing with compromized private keys (instead of revocation list of CA), etc.
  2. Use shared secret. Again, be prepared to the drawbacks. For instance, in such case not only the user, but also you on the server side will be responsible for keeping user authentication material safe.
  3. One time passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.