New answers tagged

1

Yes. There is a difference between key strength, key size and the size of the encoding of a key. The modulus of the RSA private key determines the key size, for instance, but an RSA key commonly also contains the public, private exponent and CRT parameters, an encoding structure etc. etc. In GPG indeed the "key" consists of many additional parts as well (...


0

This seems like a strange question. Curve25519 is the name of the curve and is also used to refer to a key agreement protocol using it (which is more properly called X25519), whereas Ed25519 is a signature scheme that uses the same curve (albeit represented differently). They're different applications, so what do you even mean by using curve25519 instead ...


0

The more frequently you update keys, the less data is processed with any given key, and therefore the less impact the leak will have. This goes regardless of the purpose of the key: confidentiality, authentication, or anything else. For data authentication, renewing the key limits the amount of tainted data, where it might be impossible to tell legitimate ...


0

All block ciphers leak information. No matter the mode used there is a limit on the amount of data that should be encrypted with a single key, irrespective of the number of different IVs used, in order to not leak too much information that an attacker might be able to determine some of the encrypted data. For AES, it seems that the limit seems to be around ...


0

I gave this some more thought over the weekend and came up with a simpler solution. We'll store the data encrypted with the user key. For in-transit encryption we'll use a service key. The user data will be decrypted on read with the user key and then re-encrypted with the service key before transmitting the data. The data consumer will be required to have ...


0

The correct place to store public key on the web is the certificate you request from a CA (Certificate Authority. Many are paid, but there are ones that are free). You generate your key-pair and creates a "Certificate Signing Request" and the CA issues a certificate to you once they've done some verification. Also, the public key for encryption is nowadays ...


0

The Otway-Rees protocol has been widely used as an example in the study of the formal analysis of authentication protocols, but has not been used in practice. Such implementations as exist have been in the form of input to protocol analysis tools or academic exercises. One example is a thesis Implementation of Otway-Rees Protocol. Note that this does not ...


Top 50 recent answers are included