Tag Info

Hot answers tagged

27

What is being described is a protection against some classes of known-plaintext attack. Up until the 1960s or so, most ciphers were vulnerable to these (eg. many of the attacks on the Enigma cipher were based on knowing or guessing part of the plaintext). Modern ciphers are effectively immune to this: knowing that the AES-encrypted message is "Attack at ...


17

I would imagine the context of that statement was in the context of a cypher where a word repeated in multiple places produces the same cypher text in each location. If I see: AER TEO ZRE SGR. AER FSD ZFD DFG. YTR ASD AER DSG. Language analysis would reveal that "AER" is likely "The", and from there if you intercept sufficient number of encrypted ...


8

There are schemes (1 and 2) that use environmental sensors like accelerators to generate a shared secret. Two devices are shaken while held together. The specific time, pattern and magnitude of shaking should be unique to these two devices. This data can be used to calculate a secret value only these two devices should know.


8

If I search Google for "parlaimnet biuldnig", I see: Showing results for parliament building Search instead for parlaimnet biuldnig So no, such mis-spells are not sufficient to fool automated systems or to act as a CAPTCHA. However, searching for "the bobm" Google doesn't offer me a correction, so the technique is not necessarily completely useless. ...


6

Type your example into a search engine of your choice. At least Google has no problem in correcting the relevant words, Bing even corrects them all. Input: the bobm is hdiden isnide teh parlaimnet biuldnig Google: the bomb is hidden isnide teh parliament building Bing: the bomb is hidden inside the parliament building Computers have become ...


2

Telegram was hosting a similar contest last year where they also offered a bounty, but the only attack vector they were accepting was passive eavesdropping on the traffic of one user. This was widely criticized as an unfairly restricted contest which was far away from a realistic attack scenario. This new contest, however, allows a much wider array of ...


2

LSARPC is really a set of calls, transmitted with RPC, to a system called the "Local Security Authority". This used in the Microsoft/Windows world to perform management tasks on domain security policies from a remote machine. The protocol is described in MS-LSAD. The transport medium is RPC, a part of the "Server Message Block" protocol (MS-SMB, MS-SMB2). ...


1

Why remove primes shorter than 2000 bits? According to RFC4419, the key exchange starts with the client sending it's preferences to the server in the form of 3 numbers: the minimum acceptable modulus length, the maximum acceptable length and the preferred length. Then the server chooses a random prime that best satisfies this requirement. In practice (at ...


1

The issue is that cybersecurity is not limited to vulnerabilities in software, which is what you seem to be focused on. Yes, software vulnerabilities are a big part of it, but there's much, much more. For example, take cryptography, the mathematical algorithms we depend on to secure nearly all sensitive information. In order for AI to do the work of humans, ...


1

Your question assumes that "Security" is limited to technical vulnerabilities. It is not. People are the biggest issue in "Security", and they are not going to go away ....


1

ssh is like a key (private) and the lock (public) ssl is like the door and the bricks. ssl provides a secure link between the two computer servers. eg, Yours and the one your connecting to. ssh is how the connecting computer can verify itself and gain access.


1

If the data against which you are comparing is not a secret, then it doesn't really matter what you do. Timing attacks are used to learn information to which you do not already have access. If you already have access, then the attack is unnecessary. If you are protecting a secret, then it doesn't matter if it is a password or not. You should handle it the ...


1

This is a standard approach, called a hybrid cryptosystem. Symmetric cryptography and asymmetric cryptography each have their strong and weak points. In particular: Asymmetric cryptography allows anyone to encrypt messages that only one participant will be able to decrypt, and allows anyone to verify messages that only one participant can have signed. ...


1

First, make sure you read this answer to the question "Client side password hashing", paying particular attention to the last paragraph. Also, please realize that client side javascript is going to be incredibly slow at PBKDF2 compared to good server side code. At least try to find a PBKDF2 implementation that uses HMAC-SHA-512 as a base. That said, if ...


1

The distribution of the public key is still an open problem with PGP/GPG. Upload to a public keyserver others can sign your key public with an insulting text or content you do not want to see in connection with your key many users forget the password, or loose the revocation key and changed their mail address and can not remove the old key any more. it ...


1

Yes there is such a scheme. It has been implemented by ownCloud which is an opensource cloud document storage product. It's encryption security model is described here. To summarise: Each user has a public/private key pair Each document is given a unique symmetric key with which the document is encrypted and uploaded into the backing storage container. ...


1

Yes, there's a weakness. You should change the salt every time the user changes the password, and you cannot do that with your scheme. An attacker who knows what the salt must be can mount a pre-computation attack, computing hashes for thousands of passwords. Then, even if a user changes the password, the attacker probably already has it pre-computed. ...


1

Or: client registers verifier using TSL using a self signed cert. client registers verifier encrypted with a servers vanilla RSA public key. A related question talks about these options at http://security.stackexchange.com/a/78749/45960 In the context of SRP as a password proof to a website you ideally want to use a CA signed cert and HTTPS to ensure ...


1

The Enterprise (RADIUS/EAP/802.1X) mode of WPA or WPA2 provides the following benefits over using the Personal (Pre-Shared Key or PSK) mode of WPA or WPA2: Overall it complicates the process of "hacking" the wireless. Each user can be assigned a unique login credential (username or password, security certificates, or smartcard) for the Wi-Fi, instead of a ...


1

Problem: You want to compare two sequences, a user-provided sequence U[] and a secret sequence S[] whose length you want to keep secret. You don't want to disclose, through the elapsed time of comparison, whether S is shorter than U or the length of the common prefix of U and S. You can't abort the comparison after reaching the end of S because that will ...


1

Use a Bluetooth or BLE chip on one device, and you can configure the separate device to receive data input from the BLE chip. Setup the BLE chip on the device to constantly broadcast and have the first device constantly listen. If it makes sense to include environmental data to prove two devices are in the same location, what data should be used? The ...



Only top voted, non community-wiki answers of a minimum length are eligible