Tag Info

How do I try a timing attack on a public-key implementation on a general-purpose computer?

(Note that I'm a defender, not an attacker. I'm usually confronted with descriptions of successful attacks, and tasked to defend against them. Professionals can surely mount attacks far more ...

How do I try a timing attack on a public-key implementation on a general-purpose computer?

I've seen this handled by instrumenting the function itself, calling it from a thin wrapper that computes execution time using clock_gettime or RTDSC, and outputs/logs that (preferably, at each ...
• 126k
Accepted

• 311

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

The TLS infrastructure is already there to secure the connection between the endpoints, so just slipping a shared secret or bearer token inside of it for authentication (i.e. you are who you say you ...
1 vote

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

In my experience there’s a better solution. If you look at most apis they just include the api key in the header. I believe this is the root of your concern is that it’s not hidden and there is no way ...
• 11
1 vote

How to modify elliptic curve point?

Q(5555555555) % 2500 = Q(55) how to do this ? We hope you can't do this (on a large elliptic curve, and without knowing the private key 5555555555 - if you can, then ECC is broken. After all, if you ...
• 135k
1 vote

How to modify elliptic curve point?

In standard Elliptic Curve cryptography, the private key can be reduced modulo the order of the generator point, without changing the matching public key. That order is often noted $n$. In the ...
• 126k
Accepted

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

To go along with what others have said, I also don't think this is quite right: if the platform's database is compromised, all the secrets are leaked The server should be storing a hash of the API ...
• 236

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

As Colonel Thirty Two said: "What threat model" you are trying to protect against? Threat Models A breach against the client would provide the attacker access to the private key as easily as ...
• 41

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

I don't think it makes sense to call these kinds of tokens "symmetric keys", because they are not encryption keys that are used as input to a symmetric cipher. They are bearer tokens that ...
• 391