Tag Info

Hot answers tagged

4

No. This would be a Known-plaintext attack. And SSL/TLS is hardened against that. This is the very high level essence of it. SSL/TLS is actually hybrid crypto. This means that a symmetric session key is encrypted or signed with an asymmetric crypto system. Now with your known plaintext attack you might in principle be able to derive the session key. This ...


4

Computing the public key is a problem of modular exponentiation, which can be done in O(log(e)) steps via exponentiation by squaring. On the other hand, finding the private key is the discrete logarithm problem, for which no equally efficient algorithm exists. You just have to run through all the possible values and try them all. There are some better ...


3

RFC 4346 is the source of the "daily" recommendation: An upper limit of 24 hours is suggested for session ID lifetimes, since an attacker who obtains a master_secret may be able to impersonate the compromised party until the corresponding session ID is retired. Lacking any better guidance, you're probably fine going with 24 hours. I'm not aware ...


2

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection. Sources: - @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database". - @JuiceSSH: "They [ssh keys] are stored in an ...


2

A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published. One of our SSL certificates has expired and along with that so has the keys. While the certificate will expire the public and ...


1

If the KMS holds the key then they can read the message. If the KMS is breached, then an attacker can read all messages associated with all keys that they stole. Asymmetric keys where the private key is only held by the recipient only allow the recipient to read the message so there's no worry about peeping KMS systems. If the private key is stolen, it is ...



Only top voted, non community-wiki answers of a minimum length are eligible