Tag Info

New answers tagged

-1

im a noobie myself, working on a security system myself now, so im going to share my findings, googling them will get you far. for all i discovered, the AES and MD5 encryptions are concidered unsafe. the encryptions SHA512, SHA232(or whatever) and Whirlpool came out the best. Sending non-encrypted data over a HTTPS stream is not as faulty as on a HTTP ...


1

You could look at using LDAP with public keys http://code.google.com/p/openssh-lpk/ That would make it significantly easier to re-issue a key to a user if one gets compromised. Each user's private key can be either managed by that user or saved onto storage only they have access to (e.g. home directory).


3

Exact answer depends on the involved mode of operation, but most of them begin to exhibit unwanted structure when about 2n/2 blocks have been processed, when the underlying block cipher uses n-bit blocks. The fundamental reason for this is that a block cipher like AES is a permutation: any two distinct input blocks are encrypted into two distinct output ...


1

Ultimately, many of the vulnerabilities noted in these answers come from mixing levels of trust. But if you understand how wildcard certs work, you can mitigate these vulnerabilities for particular use cases. I think that explaining this in more detail will improve the usefulness of this question and its answers. Unless all of the systems in your domain ...


3

Due to the use of the Diffie-Hellman key exchange, knowing the server's private key does not help a passive-only attacker. If the attacker wants to learn the data, then he must go active. If the attacker knows the server private key, then he can impersonate the server, i.e. run a fake server and let users connect to it. For a full Man-in-the-Middle attack, ...


1

If the client initially starts a connection with the correct server, then no, the attacker can't do anything against that connection, but if the attacker can get the user to attach to them instead, then they can play the middle man and make a connection with the client and a separate connection with the server as long as client certificates are not being ...


0

My guess would be that the worst an attacker could perform is impersonating the server, leading users to log into his system instead of the legit one. This actually means that attacker can read traffic, acting as proxy. Question is: will key-based authentication have some positive effect for client Answers of that question covering that in some ...


1

This sounds like a good task for Shamir's Secret Sharing, as Stephen pointed out in comments. One example of off-the-shelf software that can do this is Crypto++ (relevant docs: http://www.cryptopp.com/docs/ref/class_secret_sharing.html).


1

GSM uses three different security algorithms - A3, A5, and A8. The A3 algorithm is used to authenticate the mobile device, the A5 algorithm to encrypt the data transmitted, and the A8 algorithm is used to generate the session key. Hence, I believe you are interested in the A8 algorithm which deviates the session keys through a challenge and response ...



Top 50 recent answers are included