3 ms·
Servers should get away from rsa based key exchange once a user has a password. client and server then have a shared secret, good IV and a strong cipher using
by mSparks 12y ago
Servers should get away from rsa based key exchange once a user has a password.
client and server then have a shared secret, good IV and a strong cipher using that shared key, a strong IV and no more need for CA's and public keys can be nothing more than securely share the IV.
- rednovae 12y agoIf my password is catsanddogs, there is not much entropy in this password. If the connection was based off symmetric crypto from the get go, where the key was seeded from that password, you could capture some traffic and offline attack the key based off a weak user password. The alternative is safer. You would have to brute force the login online. I think you don't know what an IV is. The IV is not secret. Maybe that's where the confusion comes from?