2
votes
1answer
63 views

What to do with the extra bytes in ECDHE-RSA-AES-GCM-SHA?

I'm trying to implement, as an exercise, a protocol based on the cipher suite ECDHE-RSA-AES256-GCM-SHA384. As I understand things, ECDHE is used for the key exchange, RSA for the authenticity of the ...
0
votes
1answer
164 views

Can SHA-1 PRNG still create secure cipher keys?

I am concerned that a SHA-1 PRNG cannot produce an AES-256 cipher key with the expected 256 bits of security, or indeed any secure cipher key where over 165 bits of security are expected. The SHA-1 ...
2
votes
2answers
95 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
6
votes
1answer
519 views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
0
votes
1answer
856 views

Using JTR to crack Skype Passwords

The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
7
votes
6answers
515 views

Is leaking the hash of your encryption key a security risk?

I've been trying to design a simple archive format, that allows me to just bundle a bunch of encrypted files together. The idea, I currently have is to embed not the encryption key but a truncated ...
3
votes
2answers
199 views

Confidentiality and integrity for web session

When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...