Tagged Questions

1
vote
4answers
336 views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
1
vote
1answer
102 views

Passing generated keys to another process

I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
120
votes
7answers
7k views

How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
4
votes
3answers
184 views

Security in wireless ad hoc sensor network (without physical access)

I want to know without taking physical access, what are the methods that can steal the data in a node. When talking about eavesdropping, how can an attacker sniff the packets? Do they need to listen ...
1
vote
2answers
776 views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
5
votes
3answers
3k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
6
votes
2answers
471 views

What happens if two parties have a same pair of public&private keys

we know that we have to create Private key on server and generate its public key and create a certificate. But what if we get a private key which someone already has. Isn't the security becomes weak ...
6
votes
1answer
99 views

Creating a Private Key using Human Intervention

In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
2
votes
3answers
2k views

RSA 4096 with AES 256 Encryption Process Using PyCrypto

I have the following process for encrypting and decrypting data in a python script using the PyCrypto module: Encryption - Server A AES 256 shared key is generated Associated IV is generated Data ...
2
votes
2answers
1k views

DUKPT - Sample data other then in X9.24

I wrote some code that does PIN encryption/decryption according to rules in X9.24. It works great with examples provided in ANSI doc, but doesn't work with actual device from the client. Where can I ...