0
votes
1answer
42 views

Basis Authentication Protocol: a concrete attack

Below is an informal protocol narration of a simple authentication protocol. A sends to B a signed hash of message M, B's name and a nonce N. B knows that the message M is intended for him, that it ...
0
votes
1answer
73 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
2answers
64 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
1
vote
1answer
60 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
6
votes
1answer
1k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
4
votes
3answers
2k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
2
votes
0answers
81 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
5
votes
5answers
2k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
2
votes
1answer
556 views

Loki How to crack the password hash OSPF?

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF. Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I ...
5
votes
3answers
16k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
1
vote
4answers
383 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
18
votes
1answer
3k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
3
votes
4answers
767 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
2
votes
2answers
276 views

Does secure remote password verifier transmission need to happen out of band?

With relation to the necessity of a verifier being transmitted from the client to the server prior to any handshake steps, I was wondering how this is supposed to happen securely? To me this seems ...
1
vote
3answers
564 views

Three Message Authentication Protocol

I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
13
votes
6answers
6k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
8
votes
3answers
2k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
8
votes
1answer
739 views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...