The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
7 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
3
votes
2answers
226 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
1
vote
1answer
62 views

How can an attacker downgrade/modify the cipher suites when they are MACed? (Freak, Logjam use downgrade attacks)

In the Finished handshake of TLS all previous messages exchanged are sent from the client to the server (and reverse) and protected by a MAC. This is what also "prevents" TLS_FALLBACK_SCSV from being ...
1
vote
2answers
1k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
4
votes
0answers
1k views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
1
vote
0answers
376 views

How to unwrap exported key from safenet HSM? [closed]

I am trying to write a software that will inject keys generated inside an HSM into a POS device, in the same way as described here I'm using the Safenet emulator(software-mode) + the wrap/unwrap ...
0
votes
2answers
85 views

FREAK attack - why doesn't Finished message prevent it?

Here is my understanding of FREAK (let me know if I'm right please): 1) Client wants to use modern RSA in ClientHello 2) MITM forwards Export_RSA 3) Server says ok and sends an export RSA key, ...
2
votes
1answer
3k views

SSL cipher suite: what does “export” mean?

I saw a cipher suite EXP-EDH-RSA-DES-CBC-SHA, EXP stands for export, How do I explain the "export"? What is the different between "EXP-EDH-RSA-DES-CBC-SHA" and "EDH-RSA-DES-CBC-SHA"?
1
vote
4answers
468 views

When do governments allow export of cryptography software?

I see this notice in the TextSecure README: The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) ...
1
vote
1answer
613 views

Export ciphers prevalance

I would like to clarify the consequences of not supporting export ciphers. When I run a qualys ssl test on ebay.com, I notice that the following cipher suites are supported. ...
4
votes
2answers
817 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
-3
votes
1answer
199 views

US Export Laws (Encryption Cloud Service) [closed]

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability. So, the laws ...
2
votes
1answer
68 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
3
votes
3answers
856 views

Why have export controls for cryptography?

I've always heard someone justify the means for export restrictions with "it's for governmental control/spying". In most reasonable countries, the justice system asks people to adhere to the "spirit ...
3
votes
2answers
184 views

What International laws should one in the InfoSec industry we be aware of?

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?