0
votes
5answers
119 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
1
vote
1answer
71 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
0
votes
1answer
50 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
2
votes
3answers
91 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
0
votes
2answers
100 views

Protecting against/detecting a specific Man in the Middle attack

I'm working on a specific (hypothetical) situation, where I have two client machines attempting to perform a public key exchange, via a server. There's no possibility for a direct connection between ...
2
votes
5answers
500 views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
4
votes
1answer
427 views

What are the alternative to PKI certificates in mesh networks?

My particular problem has to do with secure communications over a mesh network (http://en.wikipedia.org/wiki/Mesh_network), in particular man-in-the-middle (MITM) attacks. The difficulty is that mesh ...
2
votes
3answers
419 views

If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?

Firstly, let me start by saying that I am not attempting to hack anyone or anything (not that I would know how or where to begin, if I were). For illustration purposes, let's call the primary key ...
6
votes
1answer
149 views

public key distribution from a central server

I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
3
votes
3answers
337 views

Two-way secure communication using two pairs of public/private keys?

Let's say I want to create a protocol to securely communicate between two endpoints - each of the two endpoints know the other's public key and all data exchanged is encryted using one's public key ...
3
votes
2answers
163 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
3
votes
2answers
450 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
0
votes
3answers
2k views

Firefox detected an invalid SSL certificate

February 14, 2012 UTC: Yesterday, I connected to a website of a VPN provider for which Firefox 8.0.1 on Windows 7 Ultimate x86-64 stated that its' SSL certificate is invalid. I saved the received ...