Tag Info

Hot answers tagged

32

One big advantage is removing the need for revocation in the event of a compromise. The "typical" way to do this is publishing a certificate revocation list (CRL) or using the OSCP protocol in the event of a compromise to revoke certificates. However, the CRL or OSCP check is incredibly easy to bypass. An attacker in a position to perform a MITM attack can ...


16

There are IT security companies which provide services like code auditing (most often along with other services like penetration testing, etc.). You contact them, describing your needs, then if this fall under their competences they will send you an estimate.


13

I heard this example during one of the guest lectures back in my grad school. I think it simple enough since I've myself used it many times, to explain ZKP to people with almost Zero Knowledge of crypto/math. Let's say that I want to convince you that I have a superpower to count the exact number of leaves on a tree, within a few seconds. I want to convince ...


7

It is unknown (except probably to Microsoft and the NSA) whether BitLocker has a back door. You cannot examine the source code to find out, either. (And even if you could, a purposeful weakness might be very difficult to spot, even for an experienced cryptographer.) TrueCrypt's source code is available and has (as of today) been audited. No back doors or ...


6

In TLS, MD5 is used as the compression function for HMAC. The best current security proof for HMAC does not require its compression function to be collision-resistant, so HMAC-MD5 is still considered secure (if distasteful). TLS 1.0 and RC4 are more disconcerting than MD5 in this case.


4

As described in this answer and in this commit to chrome only AEAD ciphers are considered state of the art security. It looks like that your server does not use the cipher preference of the client but instead has their own preference which looks like this: ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ... ...


4

Terry Chia answered the question "What is the benefit of rotating certificates so frequently?" fully correct, so there's nothing for me to add. However, I'd like to add a note that Google does frequently change their public keys as well, so the assumption of the cheat sheet is invalid. This does add pretty much confusion and may be part of the reason for ...


3

You don't know. You technically don't even know whether the password is stored at all, let alone whether it's stored hashed. Them being able to email you the password immediately after you tell it to them says nothing of storage.


3

Define a specification If you are writing/developing a new protocol before you cut code, you should start by writing a specification like a Request For Comments (RFC). Even if you never intend to publish your protocol the process is the important part. The RFC would be the basis of any assessment that you want to have done in the future. In addition to ...


3

No, not really. You can't switch because ECC and RSA are totally different algorithms that use totally different keys. The best you can do is generate a new ECC subkey which will be signed by your old RSA master key, then you can use that subkey for signing and/or encryption.


3

Now please suggest me the possible parameters to judge my algorithm. The most important parameters at the current development stage of your algorithm are probably: your understanding of other algorithms your ability to break other algorithms, or at least to fully understand how others manage to break them your knowledge of number theory your ...


3

Since this doesn't seem to have been done yet, I am going to suggest an answer from a purely information theoretical point of view: Let X, Y be two random variables in {0,1}^n. Let f(x,y) = x XOR y Now, H(X,Y) = H(X)+H(Y|X) = H(Y)+H(X|Y), and since the information entropy is always nonnegative, we have H(X,Y)>=H(X) and H(X,Y)>=H(Y). So the join random ...


3

This probably sounds like snark, but your solution only improves the situation if the two PRNGs are themselves chosen with sufficient randomness. Think of the reason that we consider a weak PRNG to be insecure: the result is statistically easy to guess some/all of, resulting in crypto and other operations that can be attacked by knowing part of the input ...


3

Yes, that's correct. That's why if you're using a hash for data integrity then you must deliver the hash by separate means (eg. posting the hash with your twitter account). To get around this problem in emails, rather than using a hash you can use public key cryptography that allows the receiver (and anyone else) to verify the signature using your public ...


2

Possibly partial answer. First an aside: you don't need to "secure" a public key by changing bits; the whole purpose and point of public-key cryptography is that it is secure even though the public key is public, which includes available to adversaries. That publickey form you have is NOT just "modulus and exponent". It is true that the last 3 bytes in ...


2

I also have this following sha512 encryption system, which was created by Sammitch Why not use password_hash? The only reason I can think of is that you are using an old version of PHP, in which case you should update PHP. I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. Don't ...


2

You should stick with /dev/urandom. Thomas Hühn has a good overview at http://www.2uo.de/myths-about-urandom/ If you are really concerned you can look at using a user space CSPRNG. Stick with well understood CSPRNGs (e.g. Blum Blum Shub, although it has some performance issues) and respected implementations. You might want to read ...


2

Depending on language and environment: US DHS and a third party host SWAMP (software assurance marketplace). You must apply for access and membership, but it's worth looking into. SWAMP


2

Create a private key with corresponding verifier for server. Rather than use a hash of a salt and password as in typical SRP, just use a random number (mod N) and not zero for the key value. In SRP implementations, the key is typically called "x", and then the verifier is g^x (mod N). SRP with a key of 0 is simply Diffie-Hellman. Now do an SRP login with ...


2

The point of strong password hashing functions is to make password processing slow so that attackers find it harder to run a brute force attack on your password. Unfortunately it makes it slower for you too; this is the limit of the exercise. At best, you make the function n times slower for you and n times slower (with the same n) for the attacker; but the ...


2

Bitlocker uses AES in CBC mode, Truecrypt and others use AES/Twofish/Serpent/cascades in XTS mode (Wikipedia: Block cipher mode of operation). CBC mode is less secure in that it allows single bit manipulation, for example switching a specific bit of data when attacker can gain physical access to the machine then return it to you. This can open backdoor ...


1

Come to think of it, you could implement an engine with a weak RNG and insert it into OpenSSL using: ENGINE_set_default(e, ENGINE_METHOD_RAND); That should make sure that the random number generator is used. Of course it may be a good idea to ignore any seed information given to the random RNG by the OpenSSL. This has the obvious disadvantage that it may ...


1

This setup is trying to match domains and ssl keys. However, I would start by questioning what are ‘domains’ here why are they important. Could the domain simply be a hash of the ssl key? That way you no longer need the CA. How are the domains assigned? If they are centrally assigned, could the ssl signing be simply provided as one step of the domain ...


1

In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing. TL; DR it depends Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider ...


1

Yeah this is explainable by how these modes work. Note: The input to the mode must be a multiple of the blocksize. (That's why this can be lower than 128-bit for a 128-bit cipher) Now observe how CBC works: NewBlock(LastCiphertextBlock,PlaintextBlock):=Encrypt(LastCiphertextBlock XOR PlaintextBlock) As you can see this can only encrypt a multiple of the ...


1

Another approach or approaches that you can take to try to solve this problem is the idea of a semi-fragile signature. A semi-fragile signature is a digital signature which can be verified even when the data undergoes a limited set of transformations. I developed the concept originally (I called it a robust signature) in context of limiting the set of ...


1

It sounds like what you really are looking for is a zero knowledge proof (or several zkps). You want to prove that (1) data belongs to a given class (general contents) and (2) that the data is within some limits (upper/lower bounds). Since you also want to transmit the data through the system, you'll need to bind the proof to the data in such a way that ...


1

That this page is using MD5 is bad. Even SHA-1 wouldn't be nice. But hashing and authentication are two different things and as far as I can see this site uses HMAC-MD5, which does't need the collision resistance although this would be nice to have. This was already discussed here. Well, the cipher suite this site is using to connect to you is pretty bad. ...


1

To expand on @aron-foster's answer, the way that this is done in public key cryptography is to first hash the message and then encrypt the hash using the sender's private key. In public key cryptography, as you likely know, data encrypted with one of the keys can only be decrypted with the corresponding key. This means that when the hash is encrypted with ...


1

Unless one is perfectly random, the end results is unclear. But if one were perfectly random, it would not be weak any more. Edit: Unless you're sure the two are completely independent of each other, the benefits may be unclear.



Only top voted, non community-wiki answers of a minimum length are eligible