Tag Info

Hot answers tagged

30

Keccak was selected by NIST on October 2, 2012 as the winner of the contest. It is widely seen as a suitable alternative to SHA-2, because the design is so different from most previous hash standards that even if SHA-2 is broken, confidence in Keccak should be relatively unaffected. It is also very fast and simple to implement in hardware. NIST and most ...


24

The SHA-3 hash competition was an open process by which the NIST defined a new standard hash function (standard for US federal usages, but things are such that this will probably become a worldwide de facto standard). The process was initiated in 2007. At that time, a number of weaknesses and attacks had been found on the predecessors of the SHA-2 functions ...


6

It was not "retired" (or "expired"), it was "withdrawn", admittedly a minor semantic distinction. NIST have the following generality to say about that: This page contains a list of withdrawn Special Publications (SPs) that have either been superseded by an updated SP or is no longer being supported and no updated version was released. Since there is ...


6

"Best" is rather subjective - it depends on your requirements. That said, I'll give you a general overview of each mode. ECB - Electronic Code Book. This mode is the simplest, and transforms each block separately. It just needs a key and some data, with no added extras. Unfortunately it sucks - for a start, identical plaintext blocks get encrypted into ...


5

NIST publishes a lot of test vectors. Including for HMAC (near the end of that page). In the file contained in the Zip archive, the vectors for HMAC/SHA-256 ought to be the ones with the parameter "L=32".


4

There's at least one usage for which SHA-2 is seemingly better than SHA-3 and that's key stretching. SHA-3 was designed to be very efficient in hardware but is relatively slow in software. SHA-3 takes about double the time compared to SHA-2 to run in software and about a quarter of the time to run in hardware. Since SHA-3 takes double the time to run in ...


4

On the 2nd of October NIST decided what algorithm was going to be used to perform hashing. This was the Keccak algorithm. The Keccak algorithm is based on the hermetic sponge strategy. It's the new standard algorithm. We use standards to make have better compatibility. Keccak was designed by Guido Bertoni, Joan Daemen (one of the creators of AES), ...


4

Believe the only way is to write your own custom password filter. There are also plenty of third party products that will do this for you e.g. http://nfrontsecurity.com/products/nfront-password-filter/ http://www.anixis.com/products/ppe/default.htm Even Windows 2008 password complexity will only check: Passwords cannot contain the user’s account name ...


1

The client proceeds as follows (I am considering only the encryption and signature steps as these are relevant for you): 1) Encryption: It generates a fresh 3DES symmetric key It encrypts the newly generated symmetric key with the public key of the server (using the RSA-PKCS1 algorithm, see EncryptionMethod algorithm) and places it into the ...


1

It's pretty easy to do with PAM, so that covers Linux/Solaris/FreeBSD at least. Among other things the pam_cracklib module offers that functionality. Its default setting is actually to check for five character changed but can be configured by the difok option.


1

The approach I would recommend for enterprises would be to integrate these systems with your directory service, which for most will be Active Directory. This way your password policy is set in a single place and it bring other benefits in managing access control and roles in a single place. You can also then provide single sign-on and two factor ...


1

I'm unsure whether this is the policy you're looking for, but perhaps it just slipped your attention. On the server side (this is Windows 2003) you have this: It allows you to define the settings for the RDP sessions over network. Otherwise it's possible this is what you are looking for. I left a comment on your question, perhaps you can clarify there if ...



Only top voted, non community-wiki answers of a minimum length are eligible