A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

0
votes
0answers
11 views

Capture SATA Commands sent to controller

I want to capture commands sent to the SATA controller to protocolize when data is read and writen on a really fundamental level. I did find some commercial hardware based solutions that provice this ...
4
votes
0answers
20 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
-1
votes
0answers
18 views

Is Yahalom protocol secure or not? [closed]

Let's consider Yahalom protocol. ​The Wikipedia says that it is less secure than Needham-Schroeder. ​ I do not understand why.​ Why is it an insecure protocol?
-1
votes
0answers
15 views

Yahalome protocol is (not) secure. Why? [closed]

Let's consider Yahalom protocol. The wikipedia says that it is less secure than Needham-Schroeder and I know how to attack on Needham-Scroeder with MitM attack. But I can't see how to attack (in any ...
0
votes
0answers
27 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
4
votes
1answer
143 views
+50

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
-2
votes
1answer
57 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
7
votes
2answers
95 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
2
votes
0answers
38 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
0
votes
1answer
37 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According ...
3
votes
2answers
87 views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
2
votes
1answer
482 views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
1answer
27 views

Security Protocol Notation Editor [closed]

Are there any editors or tools that support the secure protocol notation?
1
vote
0answers
49 views

Known insecure IoT devices [closed]

I would like to create my own twist on intelligent home using various IoT devices. My goal is to try and pentest said devices in real-life-like scenerios. I'd like to cover various popular protocols ...
0
votes
0answers
18 views

Kerberos Replay Attack- Scenario which server is not aware there is a replay attack

I'm researching about Kerberos protocol, I understand the logic of Kerberos but, I cannot solve that assumption. The case will given below: Servers check that the time stamps on authenticators are ...
2
votes
2answers
81 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
1
vote
2answers
94 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
2answers
66 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
0
votes
0answers
29 views

How to interpret Burrows–Abadi–Needham logic notation

I've seen papers with a funny notation and I'm having trouble identifying what it is and understanding what it means. This is the best resource I've come across so far (taken from here): ...
-2
votes
1answer
120 views

Is rolling your own network protocol insecure? [closed]

By now, everyone on here should know that rolling your own crypto is bad. But what's about rolling your own (encryption supporting) network protocol? I'm working on an open-source project (by now ...
-6
votes
1answer
59 views

What are the best tools available in order to reverse engineer a communication protocol? [closed]

What are the best tools available in order to reverse engineer a communication protocol?
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
1answer
124 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
0
votes
1answer
72 views

How secure is this security protocol? [closed]

I'm developing an application that will encrypt a bunch of files the client has on their machine and then send them to a server, to back them up. I need to encrypt the files so that other ...
4
votes
0answers
132 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
2
votes
2answers
734 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
2
votes
0answers
115 views

Biometric device instead of password - signature security

Lets assume that there is a biometric algorithm for user authentication which compares fingerprints with an user's signature saved in database (comparing function is not important here). Next there is ...
2
votes
1answer
1k views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
-1
votes
1answer
171 views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link ...
4
votes
1answer
115 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
1answer
52 views

Detect if AES and hmac keys are invalid

I have a server which has a configured value of AES and HMAC key. The client also should have the same keys. When the client sends a request, the server interprets this request and reads the message. ...
0
votes
0answers
63 views

Ensure that a file can only be decrypted after a specific condition is not present

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted when a specific condition is not present (I ...
1
vote
0answers
66 views

How to decrypt a file only if specific conditions are not met [closed]

I know how to decrypt a file after one or more specific environnemental conditions are met (with secure triggers). I am interested in a cryptographic sheme that would enable decryption of data only ...
-1
votes
1answer
55 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any ...
0
votes
1answer
24 views

How to interpet RFC data format

I'm having slight problems reading the used format in an Internet-Draft: TokenBindingProtocol#Section6 here enum { provided_token_binding(0), referred_token_binding(1), (255) } TokenBindingType; ...
10
votes
2answers
384 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
1
vote
2answers
95 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
0answers
156 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
66
votes
16answers
9k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
2answers
132 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
6
votes
2answers
511 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
0
votes
1answer
31 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
30 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
1
vote
1answer
536 views

Is using Chromecast “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security ...
-3
votes
1answer
282 views

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)? [closed]

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)?
3
votes
1answer
1k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
0
votes
0answers
26 views

Securing decentralised cloud scaling

Approach Require a certain percentage (quorum) of nodes to agree in order for my decentralised multicloud to grow. Benefits Reduced likelihood of growing too quickly (e.g.: 2 new nodes created ...
2
votes
1answer
138 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
0
votes
0answers
112 views

Does Miranda-IM/Miranda-NG encrypt all messages?

Since the demise of GTalk a few weeks ago, we've found that MIM seems to be the lightest instant messaging client out there. It connects to multiple chat services (MSN, Skype, Yahoo) Our main concern ...
2
votes
1answer
224 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...