Tagged Questions
15
votes
6answers
765 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
3
votes
0answers
93 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
1answer
54 views
Authenticating a ciphertext
what can be considered as a downside of authenticating a ciphertext?
For example, can we say drawback of authenticating a ciphertext is that we lose
repudiation, for example, we can't prove to the ...
3
votes
2answers
122 views
Are there any serious problems with this method for generating single-use tokens?
I need your advice on the security of this design.
I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
2
votes
0answers
75 views
How do I make or get computer certificates to use with IPSEC user authentication?
I am having trouble and need some direction using computer certificates with windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
2
votes
1answer
96 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
2
votes
2answers
90 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
6
votes
2answers
410 views
How can I prevent people from duplicating my barcodes [duplicate]
I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates.
I would like to offer a discount card that has a ...
1
vote
0answers
39 views
Can double encryption with different key increase the security? [duplicate]
Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
0
votes
1answer
102 views
Is this a secure method for authenticating clients?
I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy.
Client sends a ...
8
votes
5answers
234 views
How to support secure creation of a user account over an external API via a queued job?
So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario...
A website frontend is ...
5
votes
1answer
93 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
0
votes
0answers
49 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
1
vote
3answers
120 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
3
votes
4answers
378 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
3answers
129 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
1
vote
1answer
169 views
Picking an encryption algorithm for auth tokens passed via AJAX
I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens.
As an example:
The user will login in to the website (via OAuth, whether by the site as ...
3
votes
3answers
96 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
0
votes
1answer
50 views
WLFriends encrypted login risk
I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
0
votes
1answer
133 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
0
votes
1answer
153 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
0
votes
2answers
141 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
1
vote
4answers
143 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
3
votes
3answers
592 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
3
votes
2answers
149 views
Secure login across two web apps
I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1.
APP2 needs to know an ID of the user who is ...
5
votes
2answers
188 views
How to login and encrypt data with the same password/key
I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
3
votes
4answers
117 views
Strong authentication over insecure links
Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
2
votes
2answers
269 views
Wi-fi security using WPA or WEP
In current years we have used WPA and WPA 2 for the encryption of data sent over an 802.11 network. But in the past WEP is used . From time to time, many people say that WEP (Wired Equivalent Privacy) ...
10
votes
4answers
505 views
What is the key when facial recognition is used as a password?
I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement.
However, if it was to be used for encryption, where the role of the key is played ...
8
votes
1answer
252 views
When authenticating ciphertexts, what should be HMACed?
Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM.
However, when doing, this, what should be HMAC'd? And how? ...
4
votes
2answers
327 views
Encrypting/decrypting information in database
So, let's say I have a secret message I want to encrypt and store in my database, from where an authenticated user can retrieve, decrypt, read, update the message.
EDIT: the issue I'm encountering is ...
6
votes
3answers
2k views
How can i find what hashing algorithm was used?
One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
5
votes
3answers
335 views
Verify Login and Encrypt with PBKDF2
I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
0
votes
4answers
271 views
Are there vunerabilities with this authentication mechanism?
I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.
I was ...
4
votes
2answers
577 views
MAC vs Encryption
I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't?
I know that ...
3
votes
2answers
414 views
Can we prevent a man-in-the-middle attack with symmetric-key cryptography?
Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and ...
3
votes
4answers
239 views
Voting System, is there a hole here?
I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
4
votes
2answers
1k views
Full disk encryption and multi-factor authentication
All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
1
vote
1answer
228 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
4
votes
1answer
427 views
How secure is TOTP key on phones?
Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
26
votes
5answers
4k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
1
vote
1answer
321 views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
3
votes
1answer
232 views
Security for a low latency online multiplayer game
I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
5
votes
2answers
485 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
5
votes
2answers
203 views
System for Mutual authenticaion and confidentiality
I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
5
votes
1answer
281 views
OpenPGP Encryption / Decryption Process Using GnuPG
I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
1
vote
2answers
171 views
TCrypto - Comments about design decisions I made?
I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
