Collaborate Disseminate
For about 20 years, I’ve been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It’s worked OK for me, but gnupg is a very heavy-weight system that’s real… Continue reading Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(/Passkeys/FIDO/CTAP, whatever the name… Continue reading Is SRP/PAKE equivalent to an asymmetric crypto challenge?
I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the textbook use-case for asymmetrical keys… Continue reading Is it possible to generate a read-only key for a symmetrical encryption (AES)?
I’m using Envoy as the gateway of my micro-service backend.
Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key.
It works as expected. However, my coll… Continue reading Does jwt with asymmetric algorithm have a bad performance?
For the consumer of the API to send and receive, encrypt and decrypt into that same API, wouldn’t the client consumer also have to have the same public and private key as the server that provides the API?
Let’s say the private key for the … Continue reading Asymmetric encryption in case of multiple parties
I’ve read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I work in a research project where HTTPS mi… Continue reading Using asymmetric encryption as authentication over HTTP?
This one is a handful to describe. I’ve got on offline first stricture, server is only used for client database sync. This is a zero-trust structure. I don’t care how secure my BaaS provider is, how secure my server is or who my threat act… Continue reading What is the best way to protect public keys sitting on server against MITM attack with this zero-trust & end-to-end secure structure? [closed]
If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?
For example with a JWT, or a file hash use for audit at a later date, is keeping the private key necessary? … Continue reading Key management: Can I delete private key in asymmetric encryption?
I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user’s password and is only stored in a cookie on the user’s device, so even I as the person who has acc… Continue reading Asymmetric encryption and data sharing
My studying material states that although symmetric ciphers can be either block or stream ciphers, it also states that asymmetric can only be block ciphers without further clarification.
Continue reading Why is it impossible for assymetric ciphers to be stream ciphers?