A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

1
vote
1answer
34 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
1
vote
0answers
22 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
15
votes
6answers
10k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
3
votes
0answers
28 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
0
votes
0answers
36 views

Is the QUIC protocol secure?

QUIC is a new protocol for video streaming, that can establish a secure connection in one round. It is used in Google's new Duo app for example. How does it work and is it secure (comparison with TCP ...
0
votes
2answers
81 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
18
votes
1answer
15k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
1
vote
0answers
83 views

Why are MACs not included when defining Protocols? [migrated]

I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions. For example: A -> S: {TA, B}KAS S -> A: {TS, ...
3
votes
2answers
218 views

Biometric device instead of password - signature security

Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there ...
6
votes
1answer
168 views

What is the serious security flaw with this authentication protocol?

I've been asked to solve this security problem, as an exercise, but I have some difficulties. Some notation: C1 means Computer1 S1 means Server1, TA means Trusted Autentication system, X -> Y | Z ...
0
votes
0answers
29 views

security authentication protocol [duplicate]

I'm "creating" a secure authentication protocol for my system and it is this: C-> S C S-> C N(once) C-> S Kc,aut[N] S-> AUT Ks,aut[C,Kc,aut[N]] AUT-> S Ks,aut[N] the line : X ...
2
votes
1answer
39 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
26
votes
2answers
7k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
2
votes
1answer
93 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
4
votes
1answer
145 views

What are active research topics in SSL/TLS?

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here. I am interested in doing ...
1
vote
2answers
48 views

Dynamic, Randomized Protocols to Deter Attackers

Imagine a protocol that changed periodically. What if the order of these fields were changed a lot? One point in time the protocol might be { Payload, Checksum, Length, Flags, ID } The next point ...
278
votes
3answers
279k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
0
votes
1answer
60 views

Is there security in the 1-wire protocol?

I know that the 1-wire protocol has a slower communication and that it can be physically accessible and there other ways to get the information from the data bus. I can't seem to find much ...
2
votes
2answers
38 views

Why do ALGs restrict traffic on a given TCP port based on the protocol?

My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
2
votes
3answers
124 views

Which are the most important RFCs when learning security? [closed]

I was reading some security related blogs and write ups in internet and I started going for the RFCs instead, but they are huge, therefore impossible to learn all of them. I see those below as very ...
3
votes
2answers
2k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
8
votes
3answers
39k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
1
vote
0answers
42 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
11
votes
3answers
331 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
5
votes
2answers
2k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
0
votes
0answers
17 views

Capture SATA Commands sent to controller

I want to capture commands sent to the SATA controller to protocolize when data is read and writen on a really fundamental level. I did find some commercial hardware based solutions that provice this ...
4
votes
0answers
34 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
0
votes
0answers
34 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
7
votes
2answers
125 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
-2
votes
1answer
72 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol ...
2
votes
0answers
42 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
4
votes
1answer
162 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
4
votes
3answers
1k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
1
vote
1answer
61 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According ...
3
votes
2answers
126 views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
67
votes
16answers
10k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
1answer
40 views

Security Protocol Notation Editor [closed]

Are there any editors or tools that support the secure protocol notation?
1
vote
0answers
62 views

Known insecure IoT devices [closed]

I would like to create my own twist on intelligent home using various IoT devices. My goal is to try and pentest said devices in real-life-like scenerios. I'd like to cover various popular protocols ...
2
votes
2answers
119 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
6
votes
2answers
834 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
0
votes
0answers
26 views

Kerberos Replay Attack- Scenario which server is not aware there is a replay attack

I'm researching about Kerberos protocol, I understand the logic of Kerberos but, I cannot solve that assumption. The case will given below: Servers check that the time stamps on authenticators are ...
1
vote
2answers
109 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
2answers
90 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
-2
votes
1answer
160 views

Is rolling your own network protocol insecure? [closed]

By now, everyone on here should know that rolling your own crypto is bad. But what's about rolling your own (encryption supporting) network protocol? I'm working on an open-source project (by now ...
2
votes
0answers
71 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
-5
votes
1answer
65 views
7
votes
3answers
6k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
7
votes
3answers
1k views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a link farm in the average case. Most protocols on assorted, unknown high ports contain little or no plain text, and often if ...
4
votes
1answer
176 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
1
vote
1answer
11k views

What TLS and SSL protocols should I have turned on

I am using Explorer as my browser. What do I have to have on regarding the TLS and SSL protocols. There are several of each one.