Tag Info

Hot answers tagged

11

To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know up to TLS 1.2" and the server responds with "we will do TLS 1.0"). However, browsers know that there exist buggy servers out there, that will simply have an ...


9

The server chooses which cipher suite to use for establishing the secure channel. The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one it deems most secure (based on its own list of acceptable protocols) and that is used for the secure channel. If the server does not see any cipher suites that ...


2

Sending one type of network traffic over another protocol is called network tunneling or covert channeling. This is quite easy to do, and with some experience, you can send plaintext data over port 443 (to make it appear encrypted to the untrained eye) or send IM messaging traffic over port 80...the opportunities are endless. The method of sending data ...


2

The password in SRP is actually a shared secret of (possibly) low entropy. It can be the "password" as the human user understands it, or anything that is deterministically derived from the password. In your case, yes, using a password hashing function such as PBKDF2 is a valid approach. It has the following caveats: PBKDF2, like bcrypt and other good ...


1

The answer is no, and it's explained why in the Thomas Pornin answer to another question. From any system that doesn't require a trusted third party, there's no way to escape, since you can force them to reveal the secret at the same time. So, no matter if you encrypt it, sign it, say it louder, everybody types at the same time in a chat, reveal some hash ...



Only top voted, non community-wiki answers of a minimum length are eligible