Tag Info

New answers tagged

2

If you're using simple HTTP for communication then TLS would be the easier route. While you think you might have thought everything through it's better to use an established protocol for the following reasons: It's already supported by most browsers, operating systems, and devices. The infrastructure is already in place, with lots of examples for ...


4

TLS handshake protocol in brief: All the exchange you see before the step 9 (including the certificate exchange) is vulnerable because only after it the channel is secured. P.S. You may be interested in reading this.


7

Yes, the client certificate is sent in the clear if the server sent a certificate request. Some servers (IIRC, Microsoft IIS) first perform handshake with no user authentication and then start a renegotiation asking for client certificate. The renegotiation is thus encrypted using the cipher suite negotiated in step 1 and the client certificate is encrypted ...


2

Argon2 the winner of the PHC also allows for client side hashing. Note that this is an additional feature, and doesn't make Argon2 to a fully fledged authentication protocol. The PHC has awarded it as password hashing algorithm, not as authentication protocol. Isn't Secure Remote Password Protocol (SRP) pretty much client side hashing? For SRP, ...


0

"Secure Remote Password Protocol (SRP)" isn't "pretty much client side hashing" since SRP is a candidate PAKE protocol, so with it, the alleged server shouldn't be able to learn enough to log in. Those systems don't "avoid the plaintext equivalence problem" since the login process just consists of two messages and the server's message is predictable, ...



Top 50 recent answers are included