0
votes
2answers
25 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
3
votes
1answer
147 views

How to fix this broken crypto protocol?

I am considering a protocol where you upload a one time pad to a server, using public key encryption and then the result (using the pad) is sent back in plaintext: Alice uses Bobs RSA public key to ...
2
votes
0answers
69 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
5
votes
1answer
2k views

What block ciphers and algorithms are now safe? [closed]

I work for a large non-US based international organisation. Regarding the recent leaks about the NSA breaking most encryption on the internet, we now know the US and UK governments are actively ...
9
votes
2answers
396 views

How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?

. . .better solutions have been proposed and will be worth considering once they have withstood the test of time (i.e. “5 to 10 years in the field, and not broken yet”). -From Thomas Pornin's ...
2
votes
0answers
63 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
0
votes
1answer
300 views

What is a man in the middle attack?

My university provided me with the following slide which is confusing me: From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
1k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
24
votes
3answers
15k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
3
votes
4answers
742 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
2
votes
2answers
263 views

Does secure remote password verifier transmission need to happen out of band?

With relation to the necessity of a verifier being transmitted from the client to the server prior to any handshake steps, I was wondering how this is supposed to happen securely? To me this seems ...
1
vote
3answers
550 views

Three Message Authentication Protocol

I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
23
votes
3answers
2k views

How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?

I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
18
votes
3answers
4k views

Convergence - an SSL replacement?

Today, Moxie Marlinspike, a security researcher famous for his research on Android and SSL and related protocols (author of sslstrip/sslsniff), released "Convergence" which says is "an agile ...
10
votes
1answer
1k views

Native rsync protocol security

Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials? I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
89
votes
3answers
53k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
6
votes
2answers
6k views

The new CCMP attack against WPA/WPA2 PSK

The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
6
votes
3answers
621 views

Patent free symmetric-only key exchange protocols?

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
4
votes
3answers
373 views

Are there any serious problems with this technique for generating symmetric keys?

I'm using a technique borrowed out of a book by Bruce Schneier and Niels Ferguson called Practical Cryptography. Basically, it boils down to this: Bob does this: pubk_A = Alice's public key ...
8
votes
3answers
2k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
8
votes
1answer
714 views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...