Questions tagged [authentication]

Authentication is successfully validating that an entity you are communicating with is actually who they claim to be. The entity typically demonstrates who they are by showing they possess a secret that only they could know.

Filter by
Sorted by
Tagged with
10
votes
0answers
155 views

How exactly does ASKE (Alpha Secure Key Establishment) in Zigbee work?

I am working on Zigbee security. For key establishment, some approaches are given in Zigbee. Some of them are: ASKE (Alpha Secure Key Establishment), ASAC (Alpha Secure Access Control), and SKKE (...
2
votes
1answer
135 views

A clarification about OTR shared secrets - how long need they be secret?

A quick question on confirmation/authentication with the OTR protocol. OTR shared secrets/Q&A when used to authenticate your partner in conversation, am I correct my understanding that they DO ...
3
votes
1answer
75 views

What are the properties of error vector used in symmetric McEliece cryptosystem?

In the symmetric version of McEliece cryptosystem, we are adding intentional error vector during encryption. During decryption, first, we cancel the effect of error vector and then multiply the ...
3
votes
1answer
578 views

Encrypting data at rest using AES-GCM, where should I store MAC (Message Authentication Code)

I am trying to secure user's profile in database (data at rest). This user's profile is downloaded only after successful authentication at server (based on user's entered password and user name). The ...
3
votes
1answer
165 views

Deterministic encryption for a limited space: using HMAC as IV [duplicate]

I need a deterministic encryption scheme. Objectives: Same plaintext is always encrypted to the same ciphertext. Related plaintexts are encrypted to unrelated ciphertexts. (For example, attacker that ...
7
votes
3answers
561 views

What is the reason to separate domains in the internal hash algorithm of a merkle tree hash?

From rfc 6962 It is stated that: Note that the hash calculations for leaves and nodes differ. This domain separation is required to give second preimage resistance. That means that ...
3
votes
1answer
102 views

Does WEP protect message authenticity?

The WEP secure channel works by sending $$IV||(m||CRC(m) \oplus RC_4(K,IV)$$ where IV is an asynchronous initial vector, K is an encryption key and CRC is a cyclic redundancy check function. I know ...
5
votes
3answers
941 views

Is including the key as AAD actually dangerous?

In a recent answer, Maarten mentioned including the key is a bad idea as well. This got my curious. Is there any scientific / cryptographic analysis whether including the key in the ...
4
votes
1answer
614 views

Properties provided by GCM

In the introduction of NIST Special Publication 800-38D is said that: GCM provides assurance of the confidentiality of data using a variation of the Counter mode of operation for encryption. GCM ...
3
votes
0answers
1k views

Can you help me understand this toy example of ECDSA signing and verification? [closed]

I'm a complete newbie to ECC. but I was trying to get my feet wet with (what I thought would be) a TRIVIAL/EXTREMELY SIMPLE example of ECDSA signing and verification (that I could check by hand). I'd ...
1
vote
1answer
261 views

Authentication and encryption of messages

I have a hybrid scenario of public key cryptography in which messages between users are encrypted using AES with a symmetric key generated ad hoc. A typical hybrid system scheme considers for every ...
0
votes
1answer
108 views

Certificate revocation

When someone claims that the private key corresponding to the public key has been stolen, and sends to the CA a statement of this fact signed with respect to public key pk. Why doesn't the CA need ...
1
vote
0answers
366 views

Authentication on top of Bluetooth JUSTWORKS encrypted channel

I have an embedded device with which I need to establish a secure Bluetooth LE connection. Unfortunately, the device does not have a display. However, the device will have a private key whose ...
0
votes
0answers
147 views

Easy example of commit scheme not binding

I'm told that the following commit scheme: $(c,k) = Commit(x;r) = (Enc_r(x),(x,r))$ Does not bind which means that the sender could produce $c,k,k'$ such that: $Open(c,k) \neq Open(c,k')$ I know ...
4
votes
1answer
478 views

Why is a HMAC using a 32bit tag not prone to birthday attacks?

Why is a HMAC using a 32bit tag not prone to birthday attacks? I have read that it has something to do with the fact a birthday attack isn't really possible if the output size is not large enough. ...
0
votes
1answer
103 views

Improving the security of this tag

So we have the protocol: $Bob \to Alice \Rightarrow m\ ||\ h(m, ``secretTag")$ With above scenario, a message is passed to Alice with an authentication tag to prove that the message was sent by Bob. ...
23
votes
6answers
4k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
1
vote
1answer
299 views

Using SHA512 (or other hash) for message authentication

I need to encrypt and authenticate a stream of data so that it is resilient against unexpected power loss, so I cannot write authentication data at the end of the stream. I am currently using AES-GCM,...
3
votes
1answer
76 views

Can big numbers multiplication be a valid form of encryption?

I have a vector of int called $Xreg = [x1, x2, ..., xn]$ that I need to send from a client to a server for storage in a database. If an attacker gains access to the database or the server he shouldn'...
1
vote
2answers
1k views

How Can I decrypt this VNC Authentication handshake?

I'm trying to analyze a mobile application and I believe it is is using DES. Here is a sample of the authentication handshake. ...
1
vote
1answer
248 views

Would this authentication on a Diffie-Hellmann-key-exchanged channel work?

Before I ask my question, let me say that I don't know the math behind OTR, so I don't know if the process of authentication in OTR is any similar to this. Alice and Bob have exchanged keys using ...
1
vote
0answers
139 views

Dangers of using AES CTR without authentication - can you recover the plain text?

I understand that if a system uses AES in CTR mode (or other modes) without authentication that an attacker can flip bits to try to get the system to do something it wasn't intended to do (or wasn't ...
2
votes
2answers
293 views

Is there any digital watermark technology for raw text?

I have a demand to protect my data which can accessed by my client privately. My data is not in any document but in plain text, e.g., a JSON string. I want to protect my data against being modified, ...
0
votes
1answer
128 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
9
votes
1answer
602 views

Why does the WhatsApp protocol require elaborate computation when verifying user keys?

Reading through the WhatsApp protocol (PDF), I am trying to understand why the multiple hashing and other stuff done is required. According to the paper, one can compare the hash of the key material ...
2
votes
1answer
431 views

Birthday attack on AES-CCM with 32-bit Authentication Tag

I would like to use AES-CCM with a very small Authentication Tag length of 32 bits. Thus, I have a question about the vulnerability to birthday attacks. How vulnerable is CCM to birthday attacks? ...
1
vote
0answers
117 views

Authentication of short message based on 6-digit alphanumeric compare-and-confirm

I have two parties that want to communicate with each other based on a shared password. The protocol is using PBKDF2 (with HMAC-SHA256) to create a shared key on both sides (due to restrictions on the ...
3
votes
0answers
259 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
4
votes
1answer
2k views

How WhatsApp users authenticate themselves in end-to-end encryption?

I read the WhatsApp Security Whitepaper and I want to know how a user A, which uses ECDH (Elliptic Curve Diffie-Hellman) to compute a master_secret, can be sure that the public keys for the recipient ...
1
vote
1answer
181 views

Problems when using PBKDF2 to create an ECDSA private key from a password?

System based on, e.g.: PBKDF2, ECDSA and authenticator's random challenges. Key derived from a password would be ECDSA's private key used to sign random challenges. Is password brute force the only ...
3
votes
0answers
37 views

Authenticate a session initialisation request

Consider a system where two devices are connected via a wireless encrypted channel. The channel requires manual pairing and the data passed over the channel is also encrypted using an ephemeral ...
6
votes
3answers
927 views

Authentication impossible without pre-shared public key

Correct me if I am wrong, digital certificates require the user to have the public key for the certificate in their web browser, right? Which means it has to be pre-shared. (Say I am designing a ...
3
votes
2answers
259 views

Can the access policies defined using different access structures (Monotone Span Program and Access Trees) be used together in CP-ABE scheme?

In order to add authentication features to this CP-ABE scheme, I have tried to combine it with the ABS scheme proposed by Maji et. al. I want to use the sign() and verify() algorithms of ABS scheme. ...
1
vote
1answer
144 views

Mitigating the effects of server-compromise in an end-to-end encrypted system

I'm working on a chat system that will be end-to-end encrypted, and I've run into a problem. As you know, in end-to-end encrypted chats, the server isn't trusted at all; it's why we have fingerprint ...
3
votes
1answer
103 views

How does RFC 5652 authenticated data confirm origin and data integrity?

My reading of RFC 5652 Authenticated-Data does not give receiver confidence in originator of message, and therefore can not provide data integrity certainty. Originator process is: ...
0
votes
1answer
287 views

Differences between AEAD and ECIES when transmitting secret messages

I wonder what are the practical differences between using Authenticated Encryption and then ECIES. It looks like both require communicating the shared secret in some fashion between the parties and ...
3
votes
2answers
672 views

Using master password to encrypt and decrypt user credentials

I need a way to store third party credentials, and I want to avoid storing passwords in plain text. I can't use a hash because I will need to be able to get the raw password to log in to the third ...
5
votes
2answers
2k views

Do I really need to use the same private/public key pair in RSA?

So I'm making an Android application, I need my application to be only able to scan my own generated QR codes, and I want to make sure that nobody else can generate fake ones. The data isn't ...
6
votes
1answer
307 views

Least-weak way to authenticate using only AES ECB/CBC

I have an embedded application that needs to occasionally get secure updates from a server. The only crypto library I have available for the chip is an AES-256 cipher (ECB and CBC, encrypt/decrypt). ...
0
votes
0answers
201 views

PAN authenticatable irreversible tokenization algorithm

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets. Is it possible? Is there any standards for that from associations? I was thinking ...
1
vote
1answer
61 views

“NP-complete” authentication systems

Are there any symmetric authentication systems based on the hardness of an NP-complete problem? I understand that it doesn't really matter, since NP-completeness is about the worst case, and in crypto ...
1
vote
3answers
194 views

Is PGP's way of maintaining email security optimal? [duplicate]

I read a book called "computer networking: A top-down approach". It talked about how PGP creates an email message between Alice and Bob to maintain confidentiality, integrity, and authenticity. Let me ...
0
votes
1answer
107 views

Security when using same salt for different passwords, compared to using different salts?

I have this question I am struggling about: For example, someone suggested improving UNIX authentication by defining 3 different passwords for a user that are stored in the shadow file. All three ...
1
vote
2answers
255 views

What is a simple information authentication protocol for constrained devices?

Background: I have an application where devices will poll information from some source on the network. These devices are very basic and have modest processing and memory capabilities. Hashing (and ...
6
votes
1answer
141 views

Did authentication/signature primitives fall under the Wassenaar Arrangement?

I understand that under the Wassenaar Arrangement, encryption algorithms like AES were considered to be some sort of weapon. The legally allowed effective key sizes in export software were limited to ...
1
vote
0answers
108 views

Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...
1
vote
1answer
137 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an MDC (“Manipulation Detection Code”, as also handled in this Q&A) to provide origin authentication when using public-key encryption?
4
votes
1answer
4k views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures Questions: why ...
2
votes
1answer
390 views

How secure is MD5 for one way authentication?

I have a server S1 with an Private String (PS) as an identifier shared with a server S2. Every 10 min S1 publish the hash value of PS+the current time which is used as public identifier (PI). Every ...
2
votes
2answers
271 views

Does a key need to be signed if it is being used to decrypt a message that is already signed?

I am trying to better understand authentication. Lets say I have posted my 128-bit AES symmetric key on some forum, encrypted asymmetrically to my friend using 256-bit ECC (25519). The forum isn't ...