Re: Encryption scheme using RSA

Also - anybody could hijack an existing connection after the initial auth handshake.


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi,

in my company we are using a proprietary clear text protocol to do the
communication between client and server for a product of ours. The
protocol requires authentication, but login and password pass on the
network in clear text.

We want to modify the protocol in order to protect at least the
password. The scheme we invented is the following:

- CLIENT connects

- SERVER generates an RSA key pair and sends the private key to CLIENT

- SERVER generates a random number and sends it to CLIENT

- CLIENT obfuscate the password bits using the random number ( in a
reversible way!), encrypt the result with the public key and sends the
encrypted stuff to SERVER

- SERVER decrypts with private key, un-obfuscate and obtain the
password of CLIENT.

- SERVER validate the password and allows/denies access

I know it not a standard way to use asymmetric encryption, but I would
like to hear from you what the main flaws are in this idea.

Thanks in advance
jaqq


.

Relevant Pages

  • Re: A cryptography solution for a client/server winforms app
    ... good idea if you want to learn crypto. ... you control both the client and server, you don't even need to use a ... code the client to ignore certificate trust errors. ... encrypt the memory stream. ...
    (microsoft.public.dotnet.security)
  • Re: Encrypted files do they work for backups?
    ... I'm going to test it out myself on my own test SBS Server. ... >>If I use the administrator account, and I encrypt it EFS on a External ... >>> format you need the private key to decrypt the files ... do you have the recovery agent Encrypting File ...
    (microsoft.public.windows.server.sbs)
  • Re: Location of users private key in PKI solution
    ... If clients and server are Windows platforms, check out CAPICOM as it would ... > It sounds as though I should design the system so that the client ... > application performs the signing operation as that is the most likely ... >> The private key is typically located on the users machine. ...
    (microsoft.public.security)
  • Re: Location of users private key in PKI solution
    ... If clients and server are Windows platforms, check out CAPICOM as it would ... > It sounds as though I should design the system so that the client ... > application performs the signing operation as that is the most likely ... >> The private key is typically located on the users machine. ...
    (microsoft.public.win2000.security)
  • Re: Location of users private key in PKI solution
    ... It sounds as though I should design the system so that the client ... signing/verification technology incorporated into the server. ... Presumably the steps in signing will be as follows: ... > The private key is typically located on the users machine. ...
    (microsoft.public.security)