Tag Info

New answers tagged

0

A strong authentication mechanism that is easy for the user and provides reasonable assurance would be to stand up a CA that is not trusted by anyone other than your application. Issue each user a certificate with their UPN as the only entry in the SAN extension. Configure your application to authenticate the user via their certificate, and instruct each ...


4

You can have SSL/TLS without certificates. This is supported in the TLS standard: the "DH_anon" cipher suites involve no certificate whatsoever. But you have to remember that such an unauthenticated TLS is inherently weak against active attackers, since they cannot prevent client or server impersonation (or both at the same time, which is called a ...


0

Regarding alternatives to certificate based (asymmetric) encryption for communication protocols, symmetric encryption is a possibility such as a shared key known by both parties. Considering alternatives to SSL and in particular certificates, consider encrypting the data before it is placed on the wire. This would allow you to use any number of protocols ...


4

SSL/TLS (the underlying protocol for HTTPS) provides two features: Encryption, so that nobody could passively listen to the data. Encryption is done using a key which is somehow shared between the peers. Identification, so that you can be sure who you are talking to. This is usually done with certificates. While you might have encryption without ...


0

The data over https connection is encrypted using a private key, which is known to both sender and receiver. The sender encrypts the data using the private key and the receiver uses the same key to decrypt the data. The same key is not reused again to prevent the replay attacks. Therefore, a unique key must be used in every session. Now, the question is ...


0

No, you can't have HTTPS without use of SSL Certificate/public key. With SSL Certificate the server identifies itself to client. If you having Self-Signed Certificate you'll have HTTPS, but self-signed certificate is not trusted by modern browsers.


0

Standardization Don't expect any clients to be able to read those user IDs. User IDs following the schema provided are not part of the standard and will very likely not be implemented. This is especially valid for providing mail addresses, which do have a formalized representation, including a mailto: prefix would break that. Arbitrary Strings are Allowed ...



Top 50 recent answers are included