Is it possible to authenticate a client with encryption on a simplex communication channel without the use of authoritative root certs?

New contributor
Henk Jan is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • $\begingroup$ What do you mean by "authenticate a client"? So that the responder can be certain of the sender's identity for all received (signed) messages? What out-of-band mechanisms do you have available to establish authenticity of e.g. a public key or even to transport a secret key? $\endgroup$ – SEJPM Jul 12 at 17:39

Sure. For instance:

  1. Use PKI, register client public key (or self signed certificate) on the server and consider any registered public keys as trusted. You should understand also all drawbacks that it has, like dealing with validity period (how are you going to check if some PKs are still valid / trusted or not and should you remove them from your server PK store or not?), dealing with compromized private keys (instead of revocation list of CA), etc.
  2. Use shared secret. Again, be prepared to the drawbacks. For instance, in such case not only the user, but also you on the server side will be responsible for keeping user authentication material safe.
  3. One time passwords.

Your Answer

Henk Jan is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.