John Wood wrote: > Hi all, > > I just wanted to ask a question about RSA keys. > > I'm working on a peer to peer software project where public key > cryptography is required to enable peer to peer authentication (at > connection time the peers will sign a random challenge string to each > other to prove their identity). There is a trusted central node which > has all the public keys. > > We want our software to be really easy to use. To that end, we don't > want to make the users have to look after their private keys. Also, > since the product relates to data backup, we have to assume they will > have lost their hard drive. > > We also don't want to store the Private Keys on the trusted central > node (so we can truthfully say that we don't hold any of user's > secrets). > > So, really all we want is that they have to remember a single > password. > > So, to summarise, the requirements are: > > * Peers have to authenticate to each other (a trusted third party > is available) > * Peers must only need to remember a standard password (e.g. > "abacus123") > * Peers should not need to store RSA private keys anywhere at all > (including on the trusted server) > > What we're proposing is as follows: > > 1) We initialise the random number generator (RNG) with the user's > password (yes it will be a cryptographic RNG) > 2) We generate the RSA keys from the primed RNG > > So, if they have hardware failure, they just need to re-enter their > password and they'll get back their RSA private key (by re-priming the > RNG and repeating the generation). > > I have two questions. > > Question 1 > ------------------ > > What I'd like to know is, how insecure is our proposed scheme?
Vulnerable to offline dictionary attack. > However, what I'd really like to understand is what is the *real > world* insecurity is. Get a password guess generator. Generate one hundred thousand guessed passwords, then one hundred thousand private keys. Try each one. This is also the problem with WPA personal. Here is a better solution: Here is a better solution still: User logs in to key server using hash of his passphrase, to obtain a per user secret. The actual secret used to generate the secret key is a hash of his passphrase, and the secret provided by the key server. Limit the number of tries people can make against the key server, by giving them a reverse turing test after each failed attempt. _______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde
