Timeline for One-Time-Password securing an embedded server via OpenSSL
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 31, 2017 at 17:24 | comment | added | VincBreaker | A way to delay the leakage of the secrets could be using a secure cipher like rijndael (AES) or chacha20 and generate the keys using the users normal plain password. Once your database is leaked, the attacker would have to break the hashes to decrypt the secrets, which delays but doesn't secure. | |
| May 31, 2017 at 17:21 | comment | added | VincBreaker | No, DH hellman wouldn't help you saving the secrets since you have to recreate them (whereas DH would cause you generating a new password every time). Also 2 secs. of Google led me to this implementation already using OpenSSL github.com/gonrada/TOTP-Generator | |
| May 31, 2017 at 17:18 | comment | added | johnco3 | Thanks, yes it does sound like is similar to what I need. Do you have any idea if this can be done via OpenSSL, Regarding the disadvantages of a leaked client secret, do you think using a DH ephemeral shared key could be useful to avoid this kind of disadvantage? | |
| May 31, 2017 at 16:43 | history | answered | VincBreaker | CC BY-SA 3.0 |