Tag Info

New answers tagged

0

In TLS, the handshake messages are encoded into records. Each record has its own header. A given handshake message may be spread over several records, and a record may contain several handshake messages. The hash computations for CertificateVerify and Finished messages is over the handshake messages only: you input the successive handshake messages into the ...


0

Elliptic-curve (EC) cryptography is significantly different than traditional RSA-style cryptography. Bottom-line Up Front (BLUF): Your server can only handle RSA key exchanges given the information you provided. As a primer, both of these are asymmetric cryptographic protocols. They are used to securely transmit a SYMMETRIC key that both parties use to ...


3

"Signer's identity is unknown because it has not been included in your [...]" Apparently your PDF client is not happy about your certificate because it should have been included in your something. I suggest expanding the window in order to read the word which would follow "your", because that word will probably be a good clue about what your problem ...


1

The text you quote basically means: the file is signed with RSA, and the signature is appended "as is" to the file. There is nothing about certificates here; signatures use keys. Certificates are ways to bind public keys to identities. The passage you quote, though atrocious in many ways, is still relatively clear about the certificates: there are none here. ...


2

If you are afraid of "snooping" then why would you use signatures ? A "snooper" is a passive eavesdropper, who wants to see the data but certainly not to make you aware that your emails are inspected. They won't alter emails, or send fake emails, which are the kind of things that signatures can help against. If you want to defeat such sniffing, then you ...


1

It very much depends on what you mean with "legal risks". For example in Europe there is something called a "qualified signature". If something, a document, email etc, is signed with a qualified signature, it has full legal binding. You cannot deny having signed it (at least the proof is on the signers side that he/she did not voluntarily signed the ...


0

I think the scope of this question is a little too broad... Do you have any idea how many packets must be leaving your computer right now, just by browsing stack exchange?! If not, I suggest you download wireshark and monitor your own network card, you might be surprised! I think this is actually an interesting experiment, but you'll have to do it in ...


0

This is an assumption, but presumably your site is for the most part HTTP, then when it needs to process a payment it becomes HTTPS or forwards to a HTTPS page? If so there is a risk there, as it is possible to fool users into visiting a HTTPS page over only HTTP. For example see http://www.thoughtcrime.org/software/sslstrip/. As m1ke alludes to, you can ...


3

It's often not only the case that "payment information" is the only sensitive information. If your portal requires some sort of "login" (which it undoubtedly does), you allow many parties in between (Internet Cafe owners, ISP's, "hackers", employers, govermenments, ...) to see these credentials and take over the account. If your portal has anything in ...


3

If you try to force SSL/TLS - even without encryption - on websites and services that are not configured to use it, you will find that most of the Internet will be broken for you. For SSL/TLS to work, both ends of the connection must support it. Otherwise the connection negotiation will fail and your computer will treat the website as if it doesn't exist. ...



Top 50 recent answers are included