A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

0
votes
0answers
34 views

Is the QUIC protocol secure?

QUIC is a new protocol for video streaming, that can establish a secure connection in one round. It is used in Google's new Duo app for example. How does it work and is it secure (comparison with TCP ...
1
vote
0answers
83 views

Why are MACs not included when defining Protocols? [migrated]

I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions. For example: A -> S: {TA, B}KAS S -> A: {TS, ...
0
votes
0answers
29 views

security authentication protocol [duplicate]

I'm "creating" a secure authentication protocol for my system and it is this: C-> S C S-> C N(once) C-> S Kc,aut[N] S-> AUT Ks,aut[C,Kc,aut[N]] AUT-> S Ks,aut[N] the line : X ...
6
votes
1answer
167 views

What is the serious security flaw with this authentication protocol?

I've been asked to solve this security problem, as an exercise, but I have some difficulties. Some notation: C1 means Computer1 S1 means Server1, TA means Trusted Autentication system, X -> Y | Z ...
2
votes
1answer
39 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
2
votes
1answer
93 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
1
vote
2answers
48 views

Dynamic, Randomized Protocols to Deter Attackers

Imagine a protocol that changed periodically. What if the order of these fields were changed a lot? One point in time the protocol might be { Payload, Checksum, Length, Flags, ID } The next point ...
4
votes
1answer
143 views

What are active research topics in SSL/TLS?

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here. I am interested in doing ...
0
votes
1answer
60 views

Is there security in the 1-wire protocol?

I know that the 1-wire protocol has a slower communication and that it can be physically accessible and there other ways to get the information from the data bus. I can't seem to find much ...
2
votes
2answers
38 views

Why do ALGs restrict traffic on a given TCP port based on the protocol?

My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
2
votes
3answers
123 views

Which are the most important RFCs when learning security? [closed]

I was reading some security related blogs and write ups in internet and I started going for the RFCs instead, but they are huge, therefore impossible to learn all of them. I see those below as very ...
1
vote
0answers
39 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
0
votes
2answers
81 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
0
votes
0answers
17 views

Capture SATA Commands sent to controller

I want to capture commands sent to the SATA controller to protocolize when data is read and writen on a really fundamental level. I did find some commercial hardware based solutions that provice this ...
4
votes
0answers
33 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
0
votes
0answers
34 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
11
votes
3answers
327 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
-2
votes
1answer
72 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
7
votes
2answers
124 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
2
votes
0answers
42 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
1
vote
1answer
61 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According ...
3
votes
2answers
125 views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
3
votes
2answers
2k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
1answer
39 views

Security Protocol Notation Editor [closed]

Are there any editors or tools that support the secure protocol notation?
1
vote
0answers
61 views

Known insecure IoT devices [closed]

I would like to create my own twist on intelligent home using various IoT devices. My goal is to try and pentest said devices in real-life-like scenerios. I'd like to cover various popular protocols ...
0
votes
0answers
26 views

Kerberos Replay Attack- Scenario which server is not aware there is a replay attack

I'm researching about Kerberos protocol, I understand the logic of Kerberos but, I cannot solve that assumption. The case will given below: Servers check that the time stamps on authenticators are ...
2
votes
2answers
112 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
1
vote
2answers
108 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
2answers
90 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
-2
votes
1answer
157 views

Is rolling your own network protocol insecure? [closed]

By now, everyone on here should know that rolling your own crypto is bad. But what's about rolling your own (encryption supporting) network protocol? I'm working on an open-source project (by now ...
-5
votes
1answer
65 views

What are the best tools available in order to reverse engineer a communication protocol? [closed]

What are the best tools available in order to reverse engineer a communication protocol?
2
votes
0answers
70 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
1answer
173 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
0
votes
1answer
77 views

How secure is this security protocol? [closed]

I'm developing an application that will encrypt a bunch of files the client has on their machine and then send them to a server, to back them up. I need to encrypt the files so that other ...
5
votes
0answers
157 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
3
votes
2answers
1k views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
3
votes
2answers
216 views

Biometric device instead of password - signature security

Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there ...
3
votes
1answer
1k views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
-1
votes
1answer
224 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
4
votes
1answer
160 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
1answer
63 views

Detect if AES and hmac keys are invalid

I have a server which has a configured value of AES and HMAC key. The client also should have the same keys. When the client sends a request, the server interprets this request and reads the message. ...
0
votes
0answers
63 views

Ensure that a file can only be decrypted after a specific condition is not present

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted when a specific condition is not present (I ...
1
vote
0answers
66 views

How to decrypt a file only if specific conditions are not met [closed]

I know how to decrypt a file after one or more specific environnemental conditions are met (with secure triggers). I am interested in a cryptographic sheme that would enable decryption of data only ...
-1
votes
1answer
57 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any ...
0
votes
1answer
25 views

How to interpet RFC data format

I'm having slight problems reading the used format in an Internet-Draft: TokenBindingProtocol#Section6 here enum { provided_token_binding(0), referred_token_binding(1), (255) } TokenBindingType; ...
10
votes
2answers
396 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
1
vote
2answers
121 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
0answers
190 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
67
votes
16answers
10k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
2answers
133 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...