Re: Encryption scheme using RSA

How do you want to protect the clients against spoofed servers? In other words - there are no server authentication bits in your scheme.

Why don't you simply wrap the whole (clear text) protocol in an SslStream?

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi,

in my company we are using a proprietary clear text protocol to do the
communication between client and server for a product of ours. The
protocol requires authentication, but login and password pass on the
network in clear text.

We want to modify the protocol in order to protect at least the
password. The scheme we invented is the following:

- CLIENT connects

- SERVER generates an RSA key pair and sends the private key to CLIENT

- SERVER generates a random number and sends it to CLIENT

- CLIENT obfuscate the password bits using the random number ( in a
reversible way!), encrypt the result with the public key and sends the
encrypted stuff to SERVER

- SERVER decrypts with private key, un-obfuscate and obtain the
password of CLIENT.

- SERVER validate the password and allows/denies access

I know it not a standard way to use asymmetric encryption, but I would
like to hear from you what the main flaws are in this idea.

Thanks in advance
jaqq


.

Relevant Pages

  • Re: client -server interaction over XML supporting multiple protocols
    ... > NETBEUI to access the server to access the functionalities exposed. ... > server doesnot know in advance which client is using what protocol. ... size of the XML and Xfunctionality will determine the demands ...
    (comp.lang.cpp)
  • Re: Location of users private key in PKI solution
    ... If clients and server are Windows platforms, check out CAPICOM as it would ... > It sounds as though I should design the system so that the client ... > application performs the signing operation as that is the most likely ... >> The private key is typically located on the users machine. ...
    (microsoft.public.security)
  • Re: Location of users private key in PKI solution
    ... If clients and server are Windows platforms, check out CAPICOM as it would ... > It sounds as though I should design the system so that the client ... > application performs the signing operation as that is the most likely ... >> The private key is typically located on the users machine. ...
    (microsoft.public.win2000.security)
  • Re: What doesnt lend itself to OO?
    ... >> proxy and instructs the server to constuct the real object. ... rather than client code. ... If 'clock' is instantiated in the server, ... > for the server interface at the OOA level. ...
    (comp.object)
  • Re: Location of users private key in PKI solution
    ... It sounds as though I should design the system so that the client ... signing/verification technology incorporated into the server. ... Presumably the steps in signing will be as follows: ... > The private key is typically located on the users machine. ...
    (microsoft.public.security)