Re: Exchanging simmetric key

On 21 Jun 2006 04:14:04 -0700, gino.fagiolino@xxxxxxxx wrote, in part:

Hello gurus, please tell me what you think about this simple
key-exchange scheme between a public server and a free client available
in the internet. Both use RSA.

This sounds quite standard.

One might nitpick and ask why the public key of the client needs to be
encrypted - but perhaps the identity of the client is to be secret.

Or, one might note that instead of sending the password, even encrypted,
what perhaps should happen is this: the server keeps the individual
client's login and a hash of the client's password. To verify the
password, the server sends random data to the client, and what the
client sends back is this: first, it makes the same hash of the password
as that the server stores, then, it takes that hash, combines it with
the random data from the server, and hashes *that*, sending it back to
the server.

Such precautions with the password, although they are standard, may not
really be needed in all cases. Encrypting it with the server's public
key is good enough - and having the keys signed, as you've noted can be
done, is _very_ important, so that no one with his own public and
private keys can impersonate the server.

John Savard
Usenet Zone Free Binaries Usenet Server
More than 140,000 groups
Unlimited download to open account