A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

1
vote
2answers
42 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
0answers
31 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
63
votes
14answers
9k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
2answers
107 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
4
votes
1answer
43 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
0
votes
1answer
23 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
1
vote
0answers
21 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
1
vote
1answer
124 views

Is using Chromecast “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security ...
-2
votes
1answer
63 views

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)? [closed]

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)?
2
votes
1answer
107 views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
0
votes
0answers
22 views

Securing decentralised cloud scaling

Approach Require a certain percentage (quorum) of nodes to agree in order for my decentralised multicloud to grow. Benefits Reduced likelihood of growing too quickly (e.g.: 2 new nodes created ...
2
votes
1answer
84 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
0
votes
0answers
33 views

Does Miranda-IM/Miranda-NG encrypt all messages?

Since the demise of GTalk a few weeks ago, we've found that MIM seems to be the lightest instant messaging client out there. It connects to multiple chat services (MSN, Skype, Yahoo) Our main concern ...
3
votes
1answer
110 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
1
vote
3answers
172 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
1
vote
1answer
50 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
1
vote
0answers
28 views

How to use reflection attack in this simple protocol?

The following mutual authentication protocol has been designed to be resilient against reflection attacks. This is done by ensuring that the challenge from the initiator looks different from the ...
22
votes
9answers
3k views

Why can protocols on higher layers be left unchanged?

In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works: SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also ...
1
vote
1answer
80 views

What makes an SMS gateway insecure?

Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere ...
0
votes
0answers
27 views

TLS fallback when only one protocol is enabled

Consider I have IE with ONLY TLS 1.2 enabled. TLS 1.0 and 1.1 are disabled. (And SSLv2,v3) I have a server that only supports TLS1.2, with 1.0 and 1.1 disabled as well. Assuming they share a ...
0
votes
1answer
314 views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
1
vote
2answers
541 views

can wpa2 wifi be hacked by capturing data on an evil twin?

If I copied the wifi essid and channel and did a de-authentication to the clients of the wifi that I want to hack and started a wifi of my own with the same essid, bssid and channel and I started ...
1
vote
2answers
64 views

“Secure” drawing of lots [closed]

I want to randomly choose a game in the 50 games I have, in order to play with one of my friend. But this friend doesn't trust me, and neither do I: every time one of us pick up a game, the other ...
0
votes
1answer
124 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
-6
votes
5answers
124 views

Is SSL more secure than encoding?

I am writing a client / server program pair. I have established my own protocol and am communicating with TCP. Presently, when the client messages the server, it adds 42 to each byte (looping, 127 + 1 ...
43
votes
3answers
4k views

Is Git crowdsourcing cryptographic attacks?

A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed ...
2
votes
1answer
502 views

Which forward secrecy cipher suites are supported for TLS1.0 protocols?

May I know which are all forward secrecy ciphers supported in TLSv1.0 protocols?
1
vote
2answers
138 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
1
vote
2answers
81 views

Is there a protocol for securely trading information between possibly uncooperating agents?

Is there a protocol or best practice for trading information between parties where one, after receiving his share of the information from the others, might refuse to answer or might alter his answer, ...
1
vote
0answers
85 views

Mutual Authentication Protocol based on MAC & shared secret key

I am quite unsure about how to approach this question, was wondering if anyone could give me a nudge in the right direction, I would be most appreciative! So I've learned about the 4-way handshake ...
3
votes
1answer
69 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
4
votes
2answers
705 views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 has enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system ...
2
votes
1answer
58 views

Masking traffic in another protocol

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If ...
2
votes
2answers
788 views

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

Is TLS_FALLBACK_SCSV going to be the fix for servers that wish to keep SSLv3 enabled? If not what actions are being taken, if any, that address the vulnerability besides disabling SSLv3?
3
votes
1answer
186 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
0
votes
2answers
91 views

Impossible to make connections through closed ports?

If you have closed all your ports on your internet protocol, you cannot make a connection to that internet protocol. So how do attackers (DoS or any other means that need a connection) make a ...
8
votes
1answer
1k views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
1answer
147 views

What network protocol is Crashplan using?

I have been using CrashPlan for a while internally (i.e. local backup server). I would also like to setup off-site backup but my experience is that I have to forward a port from the router sitting at ...
0
votes
0answers
79 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
0
votes
1answer
59 views

Basis Authentication Protocol: a concrete attack

Below is an informal protocol narration of a simple authentication protocol. A sends to B a signed hash of message M, B's name and a nonce N. B knows that the message M is intended for him, that it ...
0
votes
1answer
155 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
2answers
174 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
1
vote
2answers
64 views

Is it possible to implement a secure game without having a reliable arbiter?

N players are playing a perfect information game (the kind of game where everyone knows moves of everyone) by making moves by turn (P1, P2, ..., Pn, P1, ..., Pn, ... till the game will finish). Game ...
2
votes
2answers
824 views

How does the SSL connection protocol work with self-signed certificate?

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
4
votes
4answers
342 views

What's the need of multiple implementations of SSL/TLS? [closed]

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia. So, is there really a need for all these different implementations? Wouldn't ...
-1
votes
0answers
155 views

An Efficient and Secure Dynamic Auditing Protocol for Data Storage in Cloud Computing [closed]

I am doing research on this topic and have to submit research paper in my college. I've googled many times for relevant material but didn't find anything suitable. Here are some key features : ...
0
votes
1answer
4k views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
1
vote
2answers
87 views

What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

This is a very newbie IT security question... I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need ...
3
votes
1answer
198 views

How to fix this broken crypto protocol?

I am considering a protocol where you upload a one time pad to a server, using public key encryption and then the result (using the pad) is sent back in plaintext: Alice uses Bobs RSA public key to ...
1
vote
1answer
1k views

What is the different between CMP and SCEP protocol?

What is the different between CMPV and SCEP protocol? Which one is better ?