Tag Info

New answers tagged

4

The behaviour of OpenSSL, as a library, is documented in the man page for SSL_CTX_set_tmp_dh_callback(). Basically, the library itself contains no pre-generated DH parameters and will refuse to do any "DHE" handshake until such parameters have been provided. The caller (the application which uses OpenSSL for running an SSL server) may provide DH parameters ...


1

You say this: one requirement in the audit is dual layer of security on all channels and that says it all. Your auditors don't understand how cryptography or even security actually works. If they were physicians, they would double doses for all medicines; when they transplant a kidney they would try to hook an extra kidney; when they have to cut off a ...


0

The important premise of STS is that Alice and Bob already know each other's public keys. Possibly, this "knowledge" is acquired through certificates, as part of a PKI. See the relevant quote from the Wikipedia page on STS: Public key certificates may be sent in steps 2 and 3 if the keys are not known in advance. The SSL/TLS protocol, when used with ...


0

In general, producing symmetric keys from some "secret" is called key derivation and uses a key derivation function. There are several KDF designs out there; many protocols define their own (e.g. in SSL/TLS). In fact, exploring the details of SSL/TLS would be a good idea (pedagogically speaking). There is a current "push" for defining a standard ...


0

There's nothing wrong with just truncating SHA-256 output to whatever number of bytes you need. Also, even if you're using AES-128, you might benefit from extra available bytes, e.g. to initialise a IV (if you're using AES in a mode utilising IV) or to use as a MAC key (if you're using separate primitive to authenticate data).


0

The one-time pad is hardly ever used for reasons already covered. As has been pointed out it has perfect security (assuming it was generated from a truly random source) -- since the "password" is of equal length to the message, there is no possible statistical deviation from "perfectly random" with which to break the password. Modern encryption algorithms ...


0

Before moving to an mobile app my bank used something like that for signing and logging in. They sent a card (via registered mail) with one time codes that in combination with my PIN was used to verify login.


11

Not really "Internet", but the one-time pad is documented to have been used for the Red Phone (a westernly-biased name; I don't know how they called it in Moscow). The pads were exchanged on magnetic tapes, sent by planes on a weekly basis. It is possible that the current system still uses a similar encryption method. This makes sense: though the one-time ...


2

Pidgin instant messenger has a plugin that implements OTP encryption of messages sent over the wire, called pidgin-paranoia. So there is at least one OTP cryptosystem out there. However, according to USE OTR's presentation at FOSDEM 2014, Pidgin is by no means secure software because it has 300,000+ lines of poorly audited C code, a lot of which is dealing ...


12

How would they pass they key? This gets to the root of where OTPs came from, and indeed how they got that name. This is for correspondence during wartime with ships or other similar agents[*]. When the ship leaves port, they head out with a pad of random data. When they receive an encrypted communication over the radio, they decode it using the ...


0

WikiPedia article has pretty good description on the practical weaknesses of OTP, and why not used in modern computing. To it I can only add that even on modern networks transmission is not perfect and bits can flip, and thus messages are checked (I believe by including a hash of original message) to verify that message was delivered intact. Without it, ...


3

Not supposedly; Claude Shannon famously proved that one-time-pad has "perfect secrecy", and cannot be broken with a brute force attack. But no-one uses it on the Internet because it turns out that in practice, you don't actually need perfect secrecy. I'm fine if you can brute force the encryption I'm using if it is going to take you twenty million years to ...


20

The problem with a one time pad, is that is must be equal in length (or longer) than the data being encrypted , and must never, ever, be reused. Just as you indicate, how would they send the key?, the OTP must then be sent in a secure way... however that is the problem that is usually left to the user and is generally why OTP is useless. If you have the ...


1

can't comment, but I agree with @Tom's answer, with a few points to add: SSL/TLS server authentication depends on the "strength" of the server key -- both its size, which you can see, and that it was sufficiently random, unlike for example the Debian openssl packages a few years ago that used a crippled RNG or the thousands of apparently unattended devices ...


1

Your Web browser will always try to authenticate the server's certificate; it will complain loudly when it cannot. The point about optional authentication is for the "DH_anon" cipher suites in which there is no authentication at all. Such cipher suites are, by definition, insecure against active attackers, and thus should not be used. Web browsers don't ...


0

GSM uses three different security algorithms - A3, A5, and A8. The A3 algorithm is used to authenticate the mobile device, the A5 algorithm to encrypt the data transmitted, and the A8 algorithm is used to generate the session key. Hence, I believe you are interested in the A8 algorithm which deviates the session keys through a challenge and response ...



Top 50 recent answers are included