Hot answers tagged

69

Time is relative. Cryptography lives in the ethereal world of abstract computing machines: there are machines that can do operations. Bigger machines can do operations faster. There is no clock that you can enforce; physical time has no meaning. In other words, if an attacker wants to get your file earlier, he just has to buy a faster computer. Now one can ...


56

If you do not want to involve a third party, you (the party encrypting the file) could simply release the key to decrypt the file on the target date. I have seen this done for video game releases. Customers are allowed to download an encrypted copy of the game in advance. Then, when the release time comes, the game company simply releases the key. That way, ...


44

Carefully place a spaceship broadcasting the decryption key in orbit around a black hole. The pull of gravity will delay the message until the appropriate time. Or you could just do like normal people and place the key broadcasting spaceship an appropriate number of light years away from the intended audience.


17

Use secret sharing to split a private encryption key into N parts, parameterized to allow reconstruction of the key with K or more parts, where K <= N. Best done using CRM, as described on the following page: http://en.wikipedia.org/wiki/Secret_sharing Then send each part to independent services that agree to publish at a given date in the future. Up ...


16

Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the domain. Historically, transferring ownership of a domain required something like one of the authorized contacts faxing in a signed paper. And, believe it or not, ...


11

You ask for tunneling a protocol (like HTTPS) through plain HTTP. And yes, there is at least httptunnel which does this. From the descrition: HTTPTunnel is a tunneling software that can tunnel network connections through restrictive HTTP proxies over pure HTTP "GET" and "POST" requests. But note that if you work in an environment where use of HTTPS is ...


8

Secure Communication The communication protocol must be secure. If the communication channel is insecure then the authentication is insecure. TLS/SSL is one way to secure the communication protocol. If you don't use TLS/SSL you would need to build a framework to build a secure communication protocol over an insecure link. If done properly ...


7

I believe that in order to properly design your system, you need to define what "time" means in your context, and why you chose a specific time. Assuming that your message is to be decrypted on the 29th of August 1997 at 02:14 AM, what is difference between the moment before and the moment after the deadline? Why specifically this date? You may be able to ...


5

OpenVPN uses SSL/TLS for it's secure protocol which secures data at the Transport level, while IKEv2/IPSec secures data at the IP level. Both protocols are secure. You can see this answer for comparing the two protocols for VPN use. Android Both protocols are supported by Android. OpenVPN has a mobile app, and there's also OpenVPN Connect (I'm honestly ...


5

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


5

If the only trusted party is yourself, and you can't guarantee being available when the message contents are to be made public, then what you can do instead is to build a device (physical or virtual) that will automatically make the key public at the required time, and then hide the device. An easy way would be to buy a virtual server from Amazon or any of ...


4

I will answer your question in two parts: The communication channel should be encrypted with RSA. How can I do that? RSA is really slow to encrypt whole messages. The usual way this is done is to encrypt the message with a symmetric cipher like AES, then encrypt the symmetric key using the recipient's RSA public key. Having said that, there are a lot ...


4

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but if your device uses wireless and there are people nearby they could grab this data if they wanted it. As for finding your UDP service on-line that is easy to ...


3

I'm not fully sure if this paper about time-lock encryption has been inspired by this discussion but it would be the most formal solution to the question "How to build time-lock encryption?", which is a reformulation of "How to protect data so that it can only be decrypted after a specific date?" But now let's get into the details on how this works. One ...


3

Depending on how you see it, there is one, two, three, or many more "handshakes". A first distinction is between "SSL-2.0" and "SSL-3.0 and later". The format of records and handshake messages for SSL-2.0 differs a lot from the records and messages used in subsequent protocol versions. Apart from the format and the implemented algorithms, a notable semantic ...


3

What you have thought through on your own is the standard way of doing encryption for network traffic: Generate a random symmetric key, Encrypt entire "message" using symmetric key (plus IV, nonce, etc), Encrypt symmetric key using target's (in this case, your central server) public key, Destroy the 'plaintext' symmetric key, Ship the encrypted goods to ...


3

No. The facsimile protocols T4 (Modified Huffman) and T30 (ITU-T T.82) are primarily compression algorithms there is no encryption involved. https://en.wikipedia.org/wiki/Fax#Compression Regarding the "Networked" component that primarily refers to newer fax machines which have wireless or Ethernet connectivity so that a group can send documents over the ...


3

Learning Basic Networking is very important.These are protocols specific RFC's , to gaing in-depth knowledge about a particular protocol. You can approach by : for example IP RFC 791 First study and learn IP from IP RFC,or various resoures. After Having the knowledge of IP , you can find out what are the different security problems related to IP. For ...


2

A hypothetical approach is given in the paper cited in the question (which is very interesting BTW, despite the occasional clumsy grammar) which is to use a software containing an encrypted payload, triggering off of some outside value like a news story, and have people around the world run it until such time as the payload is executed. This fails to meet ...


2

Encrypt the file with a very long key, split it up into parts, and give each part to a trusted person along with instructions not to surrender said part until the given date. You may add some redundancy by giving each part out to more people, in case one of them were to be hit by a bus. Of course, a network of computers could do this just as humans can. In ...


2

Your protocol is not safe by any means! Example for MitM: A sends random nonce G1 to B C intercepts and sends nonce G1c to B B sends back hash_k(G1c) and random nonce G2 C intercepts and sends hash_k(G1) and nonce G2c to A A verifies hash_k(G1) (is OK), then sends back hash_k(G1 | G2c) C intercepts and sends back hash_k(G1c | G2) B verifies and a ...


2

A formal proof might only be made against a formal specification. In other words: you cannot mathematically prove that a software matches a behavior if you are not able first to mathematically define this behavior. I have serious doubts that a general concept such as "anonymity" or "privacy" may be formally specified, and therefore that they can be formally ...


2

Having pentested a number of custom network protocols (all implemented on top of TCP or UDP, sometimes with (D)TLS as well), I recommend against this idea. You will get it wrong, and then you'll have a remote exploit vector. It is much, much safer to use an existing data format (JSON via HTTP is popular these days, though yes, that's a lot of overhead) with ...


2

Assuming it is communicating over a network: Wireshark and/or Tcpdump to capture and analyse data. Hex Editor to define headers, footers and other data structures within the packet streams. A lot of the traffic will most likely not be human readable characters. TCPReplay to replay the traffic, allowing you to modify and re-test. WireEdit, allows you to ...


2

These are simply Subdomains created by the website owner. ww3 is often used to share load (ww1,ww2,ww3) on their servers. In you example it seems intel created www-ssl subdomain to separate normal http traffic and https traffic on subdomain level. If you want more information why somebody is doing this, just ask google or the website owner


2

It's not exactly what you requested but at least these two are worth a look in my opinion. There's a general and abstract notation for describing security protocols, which is being used to describe quite complicated stuff such as Kerberos. The Needham-Schröder protocol can also be expressed this way. Again, not really what you were looking for, but made ...


2

My gut feeling was that I would rather direct the SNI-less connections to a different server (not the same one serving Bob), and via means that are external from the same server. Something like a Deep Packet Inspection firewall actually looking at the ClientHello versions and the SNI part. I can see two reasons against SNI-hole being parsed in the same ...


2

It is worth noting that numerous services exist online that do this sort of thing. Accellion, LiquidFiles, Dropbox, Box.com, and numerous others can grant you this kind of functionality. Depending on volume and complexity, you might even be able to leverage some marketing-oriented online service like salesforce.com or hubspot. There are a zillion things ...


2

TLD locks were created to prevent the following: > Modification of the domain name, including: > Transferring of the domain name > Deletion of the domain name > Modification of the domain contact details As per "Registrar Lock" status codes. It benefits companies who pay for it as a service (e.g. stop someone from doing ANYTHING to a domain ...



Only top voted, non community-wiki answers of a minimum length are eligible