A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

-1
votes
0answers
13 views

Is Yahalom protocol secure or not? [on hold]

Let's consider Yahalom protocol. ​The Wikipedia says that it is less secure than Needham-Schroeder. ​ I do not understand why.​ Why is it an insecure protocol?
-1
votes
0answers
15 views

Yahalome protocol is (not) secure. Why? [on hold]

Let's consider Yahalom protocol. The wikipedia says that it is less secure than Needham-Schroeder and I know how to attack on Needham-Scroeder with MitM attack. But I can't see how to attack (in any ...
0
votes
0answers
22 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
3
votes
1answer
91 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
-1
votes
0answers
28 views

Distributed Transmission in Protecting Satellites from Attacks?

Assume that the attacker knows with a time lag tau the location and input frequency of the satellite because he can detect and estimate the frequency of the satellite. He can pump a greater radiated ...
-2
votes
1answer
56 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
7
votes
2answers
90 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
2
votes
0answers
37 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
0
votes
1answer
35 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According ...
3
votes
2answers
85 views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
2
votes
1answer
440 views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
1answer
26 views

Security Protocol Notation Editor [closed]

Are there any editors or tools that support the secure protocol notation?
1
vote
0answers
48 views

Known insecure IoT devices [closed]

I would like to create my own twist on intelligent home using various IoT devices. My goal is to try and pentest said devices in real-life-like scenerios. I'd like to cover various popular protocols ...
0
votes
0answers
18 views

Kerberos Replay Attack- Scenario which server is not aware there is a replay attack

I'm researching about Kerberos protocol, I understand the logic of Kerberos but, I cannot solve that assumption. The case will given below: Servers check that the time stamps on authenticators are ...
2
votes
2answers
79 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
1
vote
2answers
94 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
2answers
64 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
0
votes
0answers
29 views

How to interpret Burrows–Abadi–Needham logic notation

I've seen papers with a funny notation and I'm having trouble identifying what it is and understanding what it means. This is the best resource I've come across so far (taken from here): ...
-2
votes
1answer
118 views

Is rolling your own network protocol insecure? [closed]

By now, everyone on here should know that rolling your own crypto is bad. But what's about rolling your own (encryption supporting) network protocol? I'm working on an open-source project (by now ...
-6
votes
1answer
58 views

What are the best tools available in order to reverse engineer a communication protocol? [closed]

What are the best tools available in order to reverse engineer a communication protocol?
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
1answer
123 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
0
votes
1answer
72 views

How secure is this security protocol? [closed]

I'm developing an application that will encrypt a bunch of files the client has on their machine and then send them to a server, to back them up. I need to encrypt the files so that other ...
4
votes
0answers
131 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
2
votes
2answers
715 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
2
votes
0answers
115 views

Biometric device instead of password - signature security

Lets assume that there is a biometric algorithm for user authentication which compares fingerprints with an user's signature saved in database (comparing function is not important here). Next there is ...
2
votes
1answer
1k views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
-1
votes
1answer
171 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
4
votes
1answer
112 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
1answer
50 views

Detect if AES and hmac keys are invalid

I have a server which has a configured value of AES and HMAC key. The client also should have the same keys. When the client sends a request, the server interprets this request and reads the message. ...
0
votes
0answers
63 views

Ensure that a file can only be decrypted after a specific condition is not present

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted when a specific condition is not present (I ...
1
vote
0answers
66 views

How to decrypt a file only if specific conditions are not met [closed]

I know how to decrypt a file after one or more specific environnemental conditions are met (with secure triggers). I am interested in a cryptographic sheme that would enable decryption of data only ...
-1
votes
1answer
55 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any ...
0
votes
1answer
24 views

How to interpet RFC data format

I'm having slight problems reading the used format in an Internet-Draft: TokenBindingProtocol#Section6 here enum { provided_token_binding(0), referred_token_binding(1), (255) } TokenBindingType; ...
10
votes
2answers
384 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
1
vote
2answers
93 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
0answers
156 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
65
votes
16answers
9k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
2answers
132 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
5
votes
2answers
492 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
0
votes
1answer
31 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
30 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
1
vote
1answer
525 views

Is using Chromecast “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security ...
-3
votes
1answer
278 views

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)? [closed]

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)?
3
votes
1answer
1k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
0
votes
0answers
26 views

Securing decentralised cloud scaling

Approach Require a certain percentage (quorum) of nodes to agree in order for my decentralised multicloud to grow. Benefits Reduced likelihood of growing too quickly (e.g.: 2 new nodes created ...
2
votes
1answer
138 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
0
votes
0answers
110 views

Does Miranda-IM/Miranda-NG encrypt all messages?

Since the demise of GTalk a few weeks ago, we've found that MIM seems to be the lightest instant messaging client out there. It connects to multiple chat services (MSN, Skype, Yahoo) Our main concern ...
2
votes
1answer
222 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
4
votes
3answers
757 views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...