Hot answers tagged

6

The IV is a random non-secret value. Its sole purpose is to prevent two similar blocks from yielding the same ciphertext as it could give information away about the structure of the plain text. In general you just generate the IV randomly and concatenate it to the ciphertext. The IV must be of the same length as the block for AES-CBC, which is 128 bits. You ...


2

Yes, you can crank up Tomcat logging to include that information using the javax.net.debug system property. That will allow you to get this sort of output, which includes the cipher suite proposed by the client: *** ClientHello, TLSv1 RandomCookie: GMT: 1073239164 bytes = { 10, 80, 71, 86, 124, 135, 104, 151, 72, 153, 70, 28, 97, 232, 160, 217, 146, 178, ...


2

I believe you're asking the wrong question. The right question is "Should someone new to security be working on a root CA?" and the answer is "probably not." It is highly likely that what you're doing will expose everyone who relies on your root CA to high risk of compromise. This has been demostrated by mature companies like Dell (see, for example, http:/...


1

You're trying to do the impossible here. You're having the localhost server authenticate the client application running in the browser. This is impossible to do securely. What you would want is to write a browser plugin/add-on. The browser plugin/add-on should only activate itself when visiting authorized sites.


1

This is the code I'm currently using: if(!url.getProtocol().startsWith("http")) throw new Exception(); InetAddress inetAddress = InetAddress.getByName(url.getHost()); if(inetAddress.isAnyLocalAddress() || inetAddress.isLoopbackAddress() || inetAddress.isLinkLocalAddress()) throw new Exception(); HttpURLConnection conn = (HttpURLConnection)(url....



Only top voted, non community-wiki answers of a minimum length are eligible