A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

0
votes
1answer
16 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
0
votes
2answers
187 views

What service could penetrate my Firewall via UDP on Port 17275?

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses. I can't find any ...
2
votes
4answers
498 views

Are custom protocols insecure?

So, I know rolling your own security is ill-advised, but for simplistic things like communicating with a home server, say, updating a grocery list, is a custom protocol fine? It won't be doing ...
0
votes
0answers
28 views

Are there any security protocols that are redundant? [on hold]

Bugs are going to happen, no matter what and are going to introduce security exploits. But, heartbleed seems to be a major threat: Certificates have to be reauthorized The exploit allows not just a ...
0
votes
2answers
59 views

What TLS and SSL protocols should I have turned on

I am using Explorer as my browser. What do I have to have on regarding the TLS and SSL protocols. There are several of each one.
6
votes
4answers
299 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
12
votes
6answers
5k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
1
vote
2answers
50 views

What steps remain for a robust, neutral and surveillance-proof Internet? [closed]

Recent leaks about widespread NSA surveillance have brought privacy and security to the forefront of the public consciousness as we strive to determine best practices in governance for the Internet ...
21
votes
3answers
4k views

Preventing artificial latency or “Lag Hacking” in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
5
votes
3answers
13k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
19
votes
3answers
13k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
6
votes
1answer
614 views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
65 views

How to extract the top-level of protocols into the csv file by using tshark command?

Here is what I tried: tshark -r test.pcap -T fields -e ip.proto > output.csv But this can only show all the protocols in the csv files. I want to show only the top level of protocol numbers such as ...
3
votes
4answers
688 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
1
vote
1answer
48 views

Protocols that are highly resistant to code injection attacks ? [closed]

After reading about language based security, it seems protocols that are defined using context-free or regular grammars are highly resistant to code injection attacks. Are there any good security ...
2
votes
0answers
58 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
1
vote
1answer
71 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
7
votes
3answers
536 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
2
votes
1answer
195 views

Using Diffie–Hellman key protocol to create a safe secret key

Let's say, I have a friend far from me and I want to send some secret messages to him. I have to say, I'm pretty newbie in security. That's why I'm wondering, does the Diffie–Hellman key exchange ...
-1
votes
3answers
340 views

China CCTV System UDP protocol isn't working

My boss is trying to invest on a CCTV solution that he orders from China, his idea is to market it here after we fine tune the process and configuration and make a few tweaks of our own. It consists ...
1
vote
1answer
1k views

POP3S vs POP3 with STARTTLS

Can you tell me if there are any differences between POP3S and POP3 with STARTTLS? What's the safest? Are there any known attacks? If you could choose about them, which would you pick?
1
vote
1answer
85 views

Two way delegation?

I am looking into using the X.509 for mutual delegation where mutual delegation is bi-directional where an entity can only delegate a task or a set of permissions to another entity if the latter is ...
4
votes
3answers
948 views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
15
votes
2answers
5k views

The inner workings of iMessage security?

This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
1
vote
2answers
543 views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
5
votes
1answer
1k views

What block ciphers and algorithms are now safe? [closed]

I work for a large non-US based international organisation. Regarding the recent leaks about the NSA breaking most encryption on the internet, we now know the US and UK governments are actively ...
9
votes
2answers
383 views

How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?

. . .better solutions have been proposed and will be worth considering once they have withstood the test of time (i.e. “5 to 10 years in the field, and not broken yet”). -From Thomas Pornin's ...
1
vote
1answer
299 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
1
vote
1answer
131 views

xmpp ssl cipher negotiation

Does anyone know how ssl ciphers are nogitiated via the xmpp protocol. When I capture packets, I see: <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> There is no hello server/client or ...
73
votes
9answers
11k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
0
votes
1answer
123 views

Is it safe not to encrypt ping packets them?

I am running encrypted communication with ping tacked on after decryption and deserialization is complete. I.e. incoming data -> split into packets -> decrypt -> deserializer -> actual message or ...
3
votes
2answers
776 views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks ...
0
votes
0answers
21 views

Minimum protocol versions for SSL setup [duplicate]

What are the suggested minimum version of SSL/TLS supported by the major browsers (IE 8+, Chrome, Firefox, Safari, Opera,...)? Can I get rid of SSL3.0 and TLS1.0 or is there still a major user base ...
20
votes
2answers
529 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
3
votes
3answers
1k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
2
votes
3answers
772 views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
2
votes
0answers
58 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
1answer
127 views

Is there a known vetted alternative to this key-exchange protocol?

I have three participants: A client A in possession of the public key Kpub A login server S in possession of the private key Kpriv Game servers B (B1, B2 etc) S and all B may share a finite number ...
2
votes
1answer
214 views

Any obvious flaws in this protocol?

Are there any particular flaws in this protocol? (Yes I know about SSL) Three participants: Login Server LS Game Server GS Client C Asymmetric key-pair Kpriv Kpub Shared 128bit secret key Ksec ...
3
votes
1answer
160 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
-2
votes
2answers
118 views

Understanding a key establishment protocol

I'm studying a one-pass key establishment protocol. Let be A client and B the Server. A sends to B: E_w(t,b,k) where t is a timestamp requested for freshness, k is the ephemeral key that will be ...
3
votes
1answer
192 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
5
votes
5answers
2k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
-3
votes
2answers
129 views

Problem with Encryption Protocol

I have a question about a encryption protocol, if it is good or not. Bob and Alice communicate over an insecure channel( a possible attacker can listen). An expert suggests the following protocol to ...
0
votes
1answer
282 views

What is a man in the middle attack?

My university provided me with the following slide which is confusing me: From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
1k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
3
votes
1answer
1k views

Creation and deployment of self-signed certificates for a two-machine scenario

Let us assume that I have two computers: client server Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
72
votes
3answers
43k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
12
votes
3answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
5
votes
1answer
896 views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...