The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
38 views

Replaying client hello from previous session

I am testing an SSL server. I need to capture the client hello and then replay the same client hello with the exact same field values. Here are the steps that I performed: Captured the client hello ...
1
vote
1answer
57 views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
4
votes
1answer
98 views

What is a replay attack for OpenVPN

I'm trying to understand why would I have less security if I disable a replay attack protection in OpenPVN config. It's not really explained in the man page, only Don't use this option unless you are ...
1
vote
3answers
269 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
1
vote
1answer
112 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
3
votes
4answers
602 views

Securing REST API without HTTPS

I'm developing a REST API but I am unable to use HTTPS without using self-signed certificates. I understand that that might be acceptable for some, but I don't want security messages popping up on ...
1
vote
0answers
63 views

how IKE (Internet Key Exchange) protocol reacts to the replay attack?

I mean how IKE in any mode (quick,aggressive, main) responds to an attacker that tries to replay one or more messages?
2
votes
1answer
973 views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
3
votes
1answer
102 views

Challenge Response with a Tan Book?

i am trying to secure a connection between a Mobile Device (Client) using a webApp and a Home Device (Server) in a potentially unsafe Wifi Network. The communication is asynchronous and i am trying ...
1
vote
1answer
237 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
-2
votes
1answer
463 views

Prevent Replay attacks via timestamp while client clock is not adjusted [closed]

I'm going to send my timestamp to server and server will check if it is in a given interval. What if My mobile clock is not adjusted (say it gives 2:00 pm while now it is 2:00 am). now I lost the ...
2
votes
1answer
883 views

When SSL detect a replay attack?

Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack? Now suppose the attacker ...
2
votes
2answers
2k views

SSL Finished message contents

Hi everyone I'm little bit confused about contents of Finished Message used during Handshake Protocol.In particular this message (client/side) contains the connection-id originally sent from the ...
1
vote
1answer
109 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
2answers
650 views

Is it safe to use Diffie-Hellman public keys as nonces to protect against replay attacks?

I have an interesting case regarding protection against replay attacks. Under the assumption that Alice and Bob have used Diffie-Hellman key exchange to establish a secure temporary session, would it ...
1
vote
1answer
946 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
2
votes
1answer
753 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
1
vote
1answer
69 views

Authentication and removing the ability to replay information from a compromised machine

Consider this scenario. You have a client machine which is compromised, and a "master" machine which monitors that client's status (IsCompromised = {True|False}). The client has an agent which ...