Related
I'm going to re-phrase my question completely so it makes more general sense (and correct my blunder with AES/RSA).
Alice has a large block of data to send to Bob via a local mailbox that isn't secure. To keep her data from prying eyes, she does this:
She generates a random 256-bit key
She uses AES-256 encryption to encrypt the data using the key
She uses Bob's public key to encrypt the key she's used
She puts the encrypted data and the encrypted key in the mailbox addressed to Bob
Mike the mailman picks up the mail from the mailbox. However, he doesn't want to lug the data all the way across the internet to Bob's place if bob isn't going to be able to decrypt it.
The question is, how can Mike ascertain whether the key has actually been encrypted using Bob's public key?
In my application I need to transport sensitive data to a data centre. To achieve this, I have an upload process that accepts files (that have already been AES-encrypted with a key, then the key is encrypted with the recipient's public key) and sends them to the data centre. The corresponding private key is held at the data centre and used to decrypt the files on receipt. This is currently in the design stage so there is some flexibility on the public/private key technology to be used but it's likely to be a C# application that's doing the work.
I would like to protect against uploading files that have NOT been encrypted using the public key (because I may waste significant bandwidth and the receiving application at the datacentre will fail to decrypt them).
So, what I want to know is how can I tell at the sending end whether a file has been encrypted using a given public key?
In a nutshell, I have an encrypted file and a public key. Has the file been encrypted with that key?
Thanks in advance etc.!
I understand that when sending a message, the message is encrypted with a public key and sent over, requiring a private key to open the encrypted message. However I wonder how both clients know the private keys. For example:
John sends a message to Alice saying "Hello World".
The message get's encrypted with a public key, and sent
Alice decrypts it with a private key.
But, how does Alice's computer know the private key, how does it get there, does it come with the encrypted message in another layer of encryption, or is it on both of the computer at the start, but how?
I am just wondering, and it would be great if anyone can please explain thanks!
Both parties generate their own private keys that stay with them. The public portion of these keys are then distributed to other parties that want to communicate with the owner of the private key.
The important part is ensuring that you are communicating with who you think you are communicating with, otherwise the middle-man could send his public key to both parties masquerading as the intended recipient.
This answer does, to some degree, assume we are talking about RSA. There are many asymmetric cryptosystems that use private/public keys that may not necessarily make sense with the terminology I've used.
In the simplest model:
Alice generates a keypair Apub / Apriv.
Bob doesn't need keys if this is RSA.
Alice sends Apub to Bob. She does this securely (exercise left to the reader).
Bob encrypts some data using Apub.
Bob sends his encrypted stuff to Alice.
Alice knew a priori (simple scenario, remember?) which key was being used, and uses Apriv to recover the data.
In more complex models entities may have many private keys. Aside from "try all of them" we can add some structure.
Alice generates a keypair Apub / Apriv. She saves these securely (exercise left to the reader).
Alice obtains an X.509 Public Key Certificate with Apub as the subject public key.
Self signed is fine here, or CA-issued is always good.
Bob still is a happy man who doesn't need to manage keys. That makes his FISMA/PCI/etc compliance audits easier.
Alice sends her certificate to Bob. She does this securely (ELTTR).
Bob (uses software which) extracts Apub from the certificate and encrypts data using it.
Bob('s software) builds a formatted message which includes a way to identify which certificate was used, and what the encrypted content is.
Maybe he just sends the whole cert back. (Probably not)
Maybe he sends the certificate Issuer Name and Serial Number values.
Maybe he sends the Subject Key Identifier extension value from the cert.
He has lots of options, as long as Alice understands what he's doing.
Bob sends this formatted message to Alice.
Alice identifies which of her several certificates was addressed in the formatted message.
Alice has a key management system and can figure out which private key to use based on the certificate.
Alice uses Apriv to recover the data.
The more complex model is a simplistic form of Enveloped CMS (Cryptographic Message Syntax) on Bob's part. Alice read the message and used something like the Windows Certificate Store (which is capable of carrying identifiers to Windows Cryptographic Key Stores for private keys) to determine the certificate and ultimately the private key.
Lots of different things could be done at the "more complex" layer. If Alice really likes managing keys she could make a different key for each person she talks to, and then know from a messages "Bobness" or "Daviosity" that she should use the private key matching the public key she gave to Bob, or Dave.
John uses Alice's public key to encrypt. Alice is the only one with the private key able to decrypt. Alice then responds, encrypting with John's public key, to which John decrypts using his private key.
I have an exam tomorrow in Advanced Development, but I am stuck on the topic of Encryption. I have read up on it at http://support.microsoft.com/kb/246071. However I am still confused.
If a message is encrypted using Asymmetric Encryption, using the public key, how is the decryptor going to know the private key with which to decrypt it? Surely the only way to do this is to make the private key public, but that defeats the object of Asymmetric Encryption.
Can someone please explain this in a way that a non-techie would be able to understand it? Its only Asymmetric Encryption I dont understand, not Symmetric Encryption. Thanks in advance.
Regards,
Richard
Edit: So to sum up all the answers in the case of a web application (the specific use for which I need to know about this):
User visits a website;
User is requested to provide a public key;
User creates public and private key-pair, keep the private one private and sends back the public key to the server;
Server uses the public key to encrypt anything which needs to be sent to the user and sends the information to the user;
User uses his / her private key to decrypt the response from the server;
User does what they need to and sends back a response to the server, using the private key to encrypt it;
Server decrypts using the public key.
Steps 4 - 7 may continue many times, or they may only happen once, or only 4 and 5 may occur.
Is this all correct? If so then it should be all I need to know for the exam. I shouldnt think I would need to know any more to get the maximum 40% should a question on this subject come up - will mention the existence of certificates and signatures though.
Thank you for all the help.
Regards,
Richard
Edit: Well I have just got back from my exam and it went fairly ok I think. But no question on cryptography came up, however... The help was appreciated anyway. Thanks all.
Regards,
Richard
A private key is meant to be known only by its legitimate user and not distributed. Its counterpart, the public key, may be distributed to anyone.
Based on this, you can get 4 operations:
encrypt using the public key
decrypt using the private key
sign using the private key
verify the signature using the public key
The next problem you may encounter is the binding of an identity to a public key (as you wouldn't want to encrypt something with or trust something signed with the public key of an impostor). There are various models of public key distributions. Typically, you can have:
a web of trust, where people sign each other's association between the public key and the identity: this is typically the PGP model.
a public key infrastructure (PKI) where you get certification authorities to produce certificates, often with intermediates, in a tree-like hierarchy. (PGP can use this model too, but this seems less common.)
Alice creates her Private Key + Public Key. She keeps her Private Key private. She makes her Public Key public.
Bob takes Alice's Public Key (he should first verify, that it's really Alice's Public Key!), and uses it to encrypt a message, which he sends to Alice.
Alice can decrypt the message using her Private Key.
Others have provided a "generic" description and I'll go deeper into the real-life side.
Most modern asymmetric encryption standards operate not with raw public and private keys, but with more complex wrappers, such as X.509 certificates or OpenPGP keys (these are two most popular asymmetric encryption infrastructures today). Both certificates and OpenPGP keys contain extra information that lets them be easily identified, searched for and managed.
Now, the encrypted data block usually includes the public part (i.e. the certificate or public OpenPGP key) used for encryption, or at least the ID (hash of this public part). The recipient of the data usually has (or is supposed to have) both public and private parts (private keys are usually kept together with certificates or public openpgp keys) at hand. So when the recipient receives the encrypted data, he knows that he needs to look his private key storage for public part with given ID (or for given public part when it's included into the encrypted data).
There exist cases when nothing is included. Then the recipient has nothing to do but try all available private keys for decryption. But such cases are rare as by default the certificate or key id are present in the encrypted data block.
The public key is provided to the "encryptor" by the "decryptor", therefore, by definition, the "decryptor" knows the private key (because it is part of the key pair created by the "decryptor".
Let's say "decryptor" = D, and "encryptor" = E.
D previously sent his public key to E, so E can encrypt the mesage. Because only D knows his own private key, only D will know how to decrypt the message E just sent him (remember: one key is used to encrypt, the other to decrypt). In this way, you get privacy.
Imagine that a server is serving public keys of the users to their partners to make encrypted communication possible. However, the server does NOT have access to the private keys..
Anyway - imagine the server is hacked and it sends not the requested public keys:
Alice requests Bob's public key
Server sends Eve's public key
Bob requests Alice's public key
Server sends Eve's public key
Alice sends a message to Bob
Server unpacks message, reads it and repacks it -> sends to Bob...
Bob sends a message to Alice
Server unpacks message, reads it and repacks it -> sends to Alice...
My question is - how to prevent such abuse? How can Alice be sure that she's using Bob's public key and vice versa?
Under the scheme you just proposed, you can't. The key here (no pun intended) is if the method used to verify the validity of the keys is compromised, you lose.
SSL tries to avoid this by creating a signature chain - some (very carefully guarded, and verified by other methods) key signs another key, signs another key, signs Alice's key. By verifying each step in the chain you can (in principle) know that the chain is valid - but if the private key along any step in the chain is compromised, you lose.
PGP (aka GPG) tries to solve the problem in a different, but similar way - keys can be signed by any number of other keys, forming a graph (called the web of trust). You select some keys that you have confirmed valid by, for example, verifying them in person, and mark them as trusted. Then any keys reachable by less than N steps (and/or from M distinct paths from different trusted roots) are also considered valid.
If you're really paranoid, you can, of course, physically hand the key to the other person. Of course, they have to be sure it's not someone disguised as you...
That said, the only truly foolproof way of verifying the validity of a key is generating it yourself... unless your hardware/OS/compiler/brain is compromised too :)
The crucial part missing here is authentication. Alice needs a way to know that she is really using Bobs public key. One way would be to exchange the keys personally but that is not always possible.
That is what the Web of Trust is for. Other parties can sign the public key of a user if they are sure that this key belongs to him. If enough (3) of your other contacts (which you trust) signed the public key of Bob, you can be relatively sure that it is his key.
This is the primary problem with public key encryption. You don't have any way to verify that the public key you receive is actually the public key for your intended recipient. The way HTTPS/SSL gets around this is through the use of trusted certificate authorities. The certificate authority signs the public key of the party in question with their private key, guaranteeing that the public key hasn't been changed since it was provided to the certificate authority. Even then, it is only guaranteed that the key provided to you when you request it is the same key that was originally provided to the certificate authority. However, if the server providing those certificates is compromised, you're still in trouble. Even having the server sign the keys as suggested above isn't fool proof if the sever itself is compromised. Ultimately, the security if your key distribution server must be maintained for this system to work.
The FAQ for PGP (Pretty Good Privacy) explains this issue.
I would also recommend reading Bruce Schneier's excellent book "Applied Cryptography" for "friendly and digestible" discussions of these topics.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 1 year ago.
Improve this question
What is the difference between encrypting some data vs signing some data (using RSA)?
Does it simply reverse the role of the public-private keys?
For example, I want to use my private key to generate messages so only I can possibly be the sender. I want my public key to be used to read the messages and I do not care who reads them. I want to be able to encrypt certain information and use it as a product-key for my software. I only care that I am the only one who can generate these. I would like to include my public key in my software to decrypt/read the signature of the key. I do not care who can read the data in the key, I only care that I am the only verifiable one who can generate them.
Is signing useful in this scenario?
When encrypting, you use their public key to write a message and they use their private key to read it.
When signing, you use your private key to write message's signature, and they use your public key to check if it's really yours.
I want to use my private key to generate messages so only I can possibly be the sender.
I want my public key to be used to read the messages and I do not care who reads them
This is signing, it is done with your private key.
I want to be able to encrypt certain information and use it as a product key for my software.
I only care that I am the only one who can generate these.
If you only need to know it to yourself, you don't need to mess with keys to do this. You may just generate random data and keep it in a database.
But if you want people to know that the keys are really yours, you need to generate random data, keep in it a database AND sign it with your key.
I would like to include my public key in my software to decrypt/read the signature of the key.
You'll probably need to purchase a certificate for your public key from a commercial provider like Verisign or Thawte, so that people may check that no one had forged your software and replaced your public key with theirs.
In RSA crypto, when you generate a key pair, it's completely arbitrary which one you choose to be the public key, and which is the private key. If you encrypt with one, you can decrypt with the other - it works in both directions.
So, it's fairly simple to see how you can encrypt a message with the receiver's public key, so that the receiver can decrypt it with their private key.
A signature is proof that the signer has the private key that matches some public key. To do this, it would be enough to encrypt the message with that sender's private key, and include the encrypted version alongside the plaintext version. To verify the sender, decrypt the encrypted version, and check that it is the same as the plaintext.
Of course, this means that your message is not secret. Anyone can decrypt it, because the public key is well known. But when they do so, they have proved that the creator of the ciphertext has the corresponding private key.
However, this means doubling the size of your transmission - plaintext and ciphertext together (assuming you want people who aren't interested in verifying the signature, to read the message). So instead, typically a signature is created by creating a hash of the plaintext. It's important that fake hashes can't be created, so cryptographic hash algorithms such as SHA-2 are used.
So:
To generate a signature, make a hash from the plaintext, encrypt it with your private key, include it alongside the plaintext.
To verify a signature, make a hash from the plaintext, decrypt the signature with the sender's public key, check that both hashes are the same.
There are two distinct but closely related problems in establishing a secure communication
Encrypt data so that only authorized persons can decrypt and read it.
Verify the identity/authentication of sender.
Both of these problems can be elegantly solved using public key cryptography.
I. Encryption and decryption of data
Alice wants to send a message to Bob which no one should be able to read.
Alice encrypts the message with Bob's public key and sends it over.
Bob receives the message and decrypts it using his private Key.
Note that if A wants to send a message to B, A needs to use the Public
key of B (which is publicly available to anyone) and neither public
nor private key of A comes into picture here.
So if you want to send a message to me you should know and use my public key which I provide to you and only I will be able to decrypt the message since I am the only one who has access to the corresponding private key.
II. Verify the identity of sender (Authentication)
Alice wants to send a message to Bob again. The problem of encrypting the data is solved using the above method.
But what if I am sitting between Alice and Bob, introducing myself as 'Alice' to Bob and sending my own message to Bob instead of forwarding the one sent by Alice. Even though I can not decrypt and read the original message sent by Alice(that requires access to Bob's private key) I am hijacking the entire conversation between them.
Is there a way Bob can confirm that the messages he is receiving are actually sent by Alice?
Alice signs the message with her private key and sends it over. (In practice, what is signed is a hash of the message, e.g. SHA-256 or SHA-512.)
Bob receives it and verifies it using Alice's public key. Since Alice's public key successfully verified the message, Bob can conclude that the message has been signed by Alice.
Yeah think of signing data as giving it your own wax stamp that nobody else has. It is done to achieve integrity and non-repudiation. Encryption is so no-one else can see the data. This is done to achieve confidentiality. See wikipedia http://en.wikipedia.org/wiki/Information_security#Key_concepts
A signature is a hash of your message signed using your private key.
Signing is producing a "hash" with your private key that can be verified with your public key. The text is sent in the clear.
Encrypting uses the receiver's public key to encrypt the data; decoding is done with their private key.
So, the use of keys is not reversed (otherwise your private key wouldn't be private anymore!).
You are describing exactly how and why signing is used in public key cryptography. Note that it's very dangerous to sign (or encrypt) aritrary messages supplied by others - this allows attacks on the algorithms that could compromise your keys.
Signing indicates you really are the source or vouch for of the object signed. Everyone can read the object, though.
Encrypting means only those with the corresponding private key can read it, but without signing there is no guarantee you are behind the encrypted object.
Functionally, you use public/private key encryption to make certain only the receiver can read your message. The message is encrypted using the public key of the receiver and decrypted using the private key of the receiver.
Signing you can use to let the receiver know you created the message and it has not changed during transfer. Message signing is done using your own private key. The receiver can use your public key to check the message has not been tampered.
As for the algorithm used: that involves a one-way function see for example wikipedia. One of the first of such algorithms use large prime-numbers but more one-way functions have been invented since.
Search for 'Bob', 'Alice' and 'Mallory' to find introduction articles on the internet.
What is the difference between encrypting some data vs signing some data (using RSA)?
Encryption preserves confidentiality of the message ("some data"), while signing provides non-repudiation: i.e. only the entity that signed it could have signed it. There are functional differences as well; read on.
Does it simply reverse the role of the public-private keys?
Absolutely not. The use of the same private keys for signing and decryption (or, likewise, the same public keys for verification and encryption) is frowned upon, as you should not mix purposes. This is not so much a mathematical issue (RSA should still be secure), but a problem with key management, where e.g. the signing key should have a shorter live and contain more protection before it is used.
For the same message, you should use the senders private key for signing and the receivers trusted public key for encryption. Commonly sign-then-encrypt is used otherwise an adversary could replace the signature with his own. Likewise you should use the private key of the receiver for decryption and the trusted public key of the sender for verification.
Furthermore, you should understand that signature generation doesn't use "encryption with the private key". Although all RSA operations are based upon modular exponentiation, the padding scheme is entirely different for signature generation. Furthermore, the public key has entirely different properties than the RSA private key in all practical uses of RSA.
For example, I want to use my private key to generate messages so only I can possibly be the sender.
That's non-repudiation property, which can be achieved by signing.
I want my public key to be used to read the messages and I do not care who reads them.
The public key should be considered known by all. If you want everybody to read the messages, then you simply do not encrypt them.
Signing will generally not influence the content of the message. The message is is considered separate from signatures. Officially such signatures are known as "signatures with appendix" where the appendix is the message. It's a bit weird name as the message is considered more important than the signature over it, but yeah. Only few signatures offer (partial) message recovery; they are not used much anymore and are generally considered deprecated.
Note that signature protocols such as CMS may deploy a container format that includes both the message and the signature. In that case you'd need first get the - still unencrypted - message out of the container, much like unzipping a file from a plain .zip archive. So the message may be hidden from view and cannot be directly used in that case.
I want to be able to encrypt certain information and use it as a product-key for my software. I only care that I am the only one who can generate these.
Encryption is used to achieve confidentiality. In the past RSA signature generation was often thought of as "encryption with the private key". However, the operations are quite different as explained above, and the later standards desperately try and separate encryption and signature generation.
I would like to include my public key in my software to decrypt/read the signature of the key. I do not care who can read the data in the key, I only care that I am the only verifiable one who can generate them.
Yes, this is called establishing trust in the public key. However, protecting your program code is very different from protecting messages. You can perform code signing but then you'd need something to check the signature outside of your code. There are operating systems that offer this.
There is Microsoft Authenticode for instance. Application stores like the iStore and Android app store may or may not use code signing, but they offer some reassurance that your application isn't cloned or at least not cloned within the store. Cryptography is not always the solution after all.
Keeping your code from being cloned / altered at all is much harder, and you'd be solidly in DRM territory if you go that way.
Is signing useful in this scenario?
Yes, absolutely. It can certainly help making sure that the messages were only signed by you, if there is trust in the public key. If it can be helpful for authenticating your application code / integrated public key depends entirely on the environment that you expect to run the code in.
In your scenario, you do not encrypt in the meaning of asymmetric encryption; I'd rather call it "encode".
So you encode your data into some binary representation, then you sign with your private key. If you cannot verify the signature via your public key, you know that the signed data is not generated with your private key. ("verification" meaning that the unsigned data is not meaningful)
Answering this question in the content that the questioners intent was to use the solution for software licensing, the requirements are:
No 3rd party can produce a license key from decompiling the app
The content of the software key does not need to be secure
Software key is not human readable
A Digital Signature will solve this issue as the raw data that makes the key can be signed with a private key which makes it not human readable but could be decoded if reverse engineered. But the private key is safe which means no one will be able to make licenses for your software (which is the point).
Remember you can not prevent a skilled person from removing the software locks on your product. So if they have to hack each version that is released. But you really don't want them to be able to generate new keys for your product that can be shared for all versions.
Python
The PyNaCl documentation has an example of 'Digital Signature' which will suite the purpose. http://pynacl.readthedocs.org/en/latest/signing/
and of cause NaCl project to C examples
What is the difference between encrypting some data vs signing some data (using RSA)?
RSA merely the only public-key cryptosystem that naively supports both public-key encryption and digital signatures.
This usually confuses beginners since various sources/lecturers that say
RSA decryption is the RSA signature.
No, it is not!
The confusing comes from the textbook RSA
the textbook RSA encryption;
message m and calculates c = m^e mod n for encryption and m = c^d mod n for the decryption.
the textbook RSA signatures;
message m and calculates sg = m^d mod n for verification and m == sg^e mod n for the signature verification.
Both are not secure and they are not used in the real-life!
Does it simply reverse the role of the public-private keys?
No, it is not!
Encryption
For RSA encryption one must be using either RSASSA-PKCS1-v1_5 padding or Optimal Asymmetric Encryption Padding (OAEP). These paddings have overhead to the message. For example, PKCS1-v1_5 defined as
It has an EM structure as this
EM = 0x00 || 0x02 || PS || 0x00 || M.
so what are they;
PS is at least eight FFs block
M is the message
the first 0x00 guarantees that EM is less than the modulus.
The rest details like the size of FF block etc. can be found in rfc 8017 section 7.2.1
So it has a special message structure to be secure which is proven to be secure very lately (2018). The padding has at least 11-byte overhead.
Signature
The correct term for signature is signing and verification. For secure signing, RSA needs RSA-PSS (Probabilistic signature scheme). The structure is a bit complex, a picture will tell most of it
Once you hash the message and properly padded, then you can use your private key to sign your padded message!
For the verification, use the public key on the signed message and verify using the padding rules.
Prefer OAEP since RSASSA-PKCS1-v1_5 hard to implement correctly and those incorrect implementations caused many attacks over the year despite that is is proven to be secure.
Let finish all with the Cornell University page;
RSA Signing is Not RSA Decryption