In a client-server model, the server serves services to the client.
-1
votes
1answer
46 views
Emulating Client by sending encrypted hexdump to dB server and getting response back [closed]
So I used wireshark to retrieve a hexdump that has been encrypted with RSA.
I need to figure out what the response to that would be when it comes back from the server.
How I imagine it would work ...
3
votes
2answers
422 views
Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?
we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
-1
votes
1answer
52 views
How do server know the CSR sender is approved client?
Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection.
The prblem is anyone can POST a CSR to the server and then ...
2
votes
1answer
200 views
OpenVPN: Storage location and creation of keys/certificates?
I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance.
It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
1
vote
4answers
190 views
Authentication with an untrusted server
I asked a related question earlier, but I want to ask a broader version this time:
To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
2
votes
1answer
128 views
What should a client verify after getting a client certificate?
I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String.
the String is then decoded to a x509Certificate (using Bouncycastle's ...
1
vote
1answer
312 views
Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?
I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used.
Some options came to my mind:
Store the password ...
3
votes
2answers
660 views
How to troubleshoot “client certificate” related errors in 2 way HTTPS
I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
0
votes
1answer
79 views
Create https session between server and client
I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
1
vote
1answer
329 views
When SSL detect a replay attack?
Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack?
Now suppose the attacker ...
2
votes
2answers
184 views
OpenSSL SSL enabled client application, server verification?
I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
23
votes
1answer
3k views
Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate.
Why would any non-malicious web site do that unless I've ...
1
vote
1answer
169 views
Client authentication flaw in old Netscape SSL protocol
Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
3
votes
1answer
671 views
Using client certificates for website authentication
I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
0
votes
1answer
228 views
What are the risks of connecting via VNC to an untrusted host?
There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled.
What about when connecting via VNC? What risks are there to the client?
To be clear: ...
1
vote
2answers
3k views
iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)
As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2.
...
0
votes
1answer
92 views
Transmission of messages
I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
4
votes
3answers
2k views
Revoke a certificate without index.txt
I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
1
vote
2answers
289 views
How to uniquely identify / tag client devices to whitelist VPN access?
I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access.
(Note: This is a thought-experiment at the moment, ...
2
votes
2answers
307 views
Web Service Security Checklist - Tracing and Debugging
I have been reading this security checklist about web service design:
http://msdn.microsoft.com/en-us/library/ff648304.aspx
One of the suggestions is that you should disable the following in ...
2
votes
2answers
214 views
SSL/TLS Client Authentication by IP
Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example:
There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
5k views
Certificate Chain checking
I have a very specific question.
A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
38
votes
5answers
3k views
Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately.
They seem to have raised VC funding and are offering a free password management and ...
2
votes
2answers
511 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
616 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
6
votes
1answer
5k views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
6
votes
2answers
571 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
0answers
254 views
Fuzz a client with sulley [closed]
I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
1
vote
1answer
153 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
606 views
Keeping the password secret over regular http
I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
11
votes
5answers
3k views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
