Tag Info

New answers tagged

1

Ok, so you want authenticated transactions, so why not just sign each transaction message together with the time. Use asymmetric encryption - my assumption is symmetric encryption is used by multiple users. Once again it's a toss up between computational power and convenience. So symmetric might be a good idea if you're on a low powered system. Then again, ...


2

Is this algorithm safe enough? Depends. What's your threat model. That question literally cannot be answered without creating a model of how determined and how resourceful your threat is. That being said, I would generally say, "no, not safe enough." If you have found that the inputs are multiplied together in the first step, that automatically starts to ...


1

Stringify the sent information in a standard way, take the SHA256 hash, sign it with the private half of the key-pair that is genned for the handset when the application is installed (the public half is sent to the server at enrollment time). Most importantly, HMAC is easy to do wrong because it is crypto and crypto is really hard to do right (even Ron ...


0

From reading the source it looks like the secret is stored on the Yubikey and stored encrypted multiple times with different keys inside the otp.xml file. The encryption keys are derived from the next n OTPs (derived from the secret) starting from OTP i..i+m where i is the current counter and m is the look ahead value. When the user enters their OTP values, ...


1

KeeChallenge is based on the predictable result of HMAC-SHA1 with a known key. The key in the XML file is encrypted using the result of performing HMAC-SHA1 on the challenge also stored in the XML file. To decrypt the key, the challenge is passed to the Yubikey which performs HMAC-SHA1 to generate the same value that was used to encrypt the key data last ...


2

Like @user2313067 pointed, this problem is happening probably because the clock of your server is with wrong time. Google Authenticator is an implementation of OTP (One-time password) and it is based on a private seed and on time to check if the code you are entering is correct.



Top 50 recent answers are included