Tag Info

New answers tagged

1

The difference is : OAuth 2.0 is a standardized protocol, and there is many implementations in differents langages (JAVA, Python, PHP, JavaScript...etc) for both client and server sides. So you don't need to follow this article to implement something which "seems" similar to the OAuth 2.0 protocol and probably not secured. For the cookie-based token ...


1

To detect tampering, you first have to define tampering. You are receiving a message; what would make it a "tampered" message and not the "genuine" message ? The usual definition of tampered/genuine uses the message source: at one point in space-time, the message was assembled or verified by an entity S, who declares it correct. This is the definition of ...


1

No The recipient must know something about the sender to detect tampering. Otherwise, there is nothing to distinguish the legitimate sender from someone who is tampering. There are a few choices for what the recipient knows: Shared secret key - to produce a MAC Sender's public key - to verify a signature Trusted third party's public key - to verify a ...


3

Using the same key for two distinct algorithms incurs the risk of interactions. An extreme example is when you use both AES/CBC for encryption and CBC-MAC as MAC algorithm: if you use the same key for both, then it is pretty obvious that the MAC can be trivially worked around. For AES/CBC + HMAC, the gut feeling of most cryptographers is that the two ...



Top 50 recent answers are included