4 ms·
> Those functions encrypt a block of data to a public key without authentication. How is that a problem? I mean, this is not symmetric crypto where the 2 parti
by loup-vaillant 10y ago
> Those functions encrypt a block of data to a public key without authentication.
How is that a problem? I mean, this is not symmetric crypto where the 2 parties are supposed to share a secret session key. While you generally do want authentication, I can imagine a use case for anonymous messages.
Anonymous messages cannot have authentication. Even if they had, the attacker can just block your message and forge another with another public key of his. The receiver won't make a difference, it's a throwaway key to begin with.
Did I miss something? In crypto, I often do.
- zrm 10y ago> How is that a problem? The problem is it has the wrong default. The equivalent in NaCl is crypto_box(), which requires the sender's private key to authenticate the message. If you really wanted anonymous messages then you could generate a new private key for each message and immediately throw it away, which gives you a much stronger signal that you're doing something unusual. What those OpenSSL functions do is generate a symmetric key, encrypt the symmetric key with the public key (to give to the recipient), and then encrypt the data with a symmetric cipher using the symmetric key. Those are each already basic primitives, so all the combined function is really doing is making it easier to do something insecure that most people would rarely actually want. It's possible to use it correctly, but it's too easy to use it incorrectly. Doing something uncommon with bad security properties should be possible but not easy.
- caf 10y agolibsodium, on the other hand, provides a function that does exactly that underneath - crypto_box_seal().