full-disclosure - Time Expiry Alogorithm??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200411220057922.SM02072@void>
From: thalm at void.my-bulldog.com (Tiago Halm)
Subject: Time Expiry Alogorithm??

Gautam R. Singh <gautam.singh@...il.com> wrote:
> I was just wondering is there any encrytpion alogortim which expires
> with time.
> For example an email message maybe decrypted withing 48 hours of its
> delivery otherwise it become usless or cant be decrypted with the
> orignal key

Scenario:
Lets imagine there is a "trusted", non-hackable third-party which handles a
timestamp database along with private/public keys. Lets cal it Trent. Trent
manages timestamps in terms of existence and validity. Each timestamp can
only be used once and only once. Each timestamp, as soon as it is created
has also associated a validity window outside of which it will be considered
as invalid. Whenever a timestamp its checked for existence, it will be
marked as used, and hence becomes invalid afterwads. Each timestamp is also,
obviously, unique.

Alice has a message. Alice asks Trent for a timestamp. She generates a hash
of the message, and then she signs the hash and the timestamp with her
private key. She sends the message and the signature to Bob.

When Bob receives the message, Bob decrypts the signature with Alice's
public key and sends Trent the timestamp for validity check. Trent finds the
associated timestamp in its database, sends Bob a positive response and
invalidates the timestamp.

While Bob wants to be sure the message originates from Alice, Alice wants
the message to be valid (as originating from her) for only a certain period
of time.

Conclusion:
If a certain validity (48h) is given to the timestamps, this may lead to a
valid solution for the situation described above.
How reasonable is this?

Note:
Trent, can of course, be interpreted/achieved by various implementations,
while maintaining the model described above ...

Tiago Halm

---
[This E-mail has been scanned for viruses but it is your responsibility 
to maintain up to date anti virus software on the device that you are
currently using to read this email. ]