Questions tagged [custom-scheme]
The custom-scheme tag has no usage guidance.
22
questions
2
votes
2
answers
86
views
Can this scheme be circumvented?
I am currently developing software, in which players essentially make a "bet".
While not exactly congruent to my situation, I will use the example of a randomly shuffled 52 card deck, in ...
- 634
0
votes
2
answers
134
views
Does using subkeys provide better protection in this instance?
I was thinking of implementing the following scheme for encryption of many independent files:
From the password, which is given by the user, generate a master key using for example HMAC-SHA.
From ...
- 225
0
votes
1
answer
115
views
Cryptographic File Storage scheme
First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present.
I had a scheme for remote file storage as an attempt to use my course ...
- 103
178
votes
12
answers
25k
views
Why is it wrong to *implement* myself a known, published, widely believed to be secure crypto algorithm?
I know the general advice that we should never design¹ a cryptographic algorithm. It has been talked about very extensively on this site and on the websites of professionals of such caliber as Bruce ...
- 5,747
8
votes
4
answers
338
views
How much security expertise does a general application programmer need to develop software ethically? [closed]
I am curious about this. I saw this thread:
Why shouldn't we roll our own?
and this answer:
https://security.stackexchange.com/a/18198/144241
which had on it this comment, which had the second ...
- 181
2
votes
1
answer
207
views
Slow Hashing Without a Salt?
I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
- 23
0
votes
1
answer
330
views
What is the name of this token-authentication scheme?
I'm working on a specific security design. When reading it, it looks like some form of OATH but I'm not sure which kind.
The scheme is as follows:
The client authenticates through a web-portal (...
- 101
3
votes
1
answer
177
views
Is this a valid secure cookie scheme?
I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am ...
- 131
0
votes
1
answer
108
views
Does this authentication scheme exist?
For an IoT project I've defined a simple security schema. Does this already exsist and if so, how is it called?
Definition:
There is one root key.
With every key, a child key can be generated....
- 101
0
votes
3
answers
302
views
Double-hashing authentication scheme
Rate my authentication scheme? (This feels simple enough to be a duplicate, but it's really hard to search for these types of questions. Sorry if it is a duplicate.)
When a password is set, it's ...
- 207
2
votes
2
answers
224
views
Simple-to-implement ad-hoc password validation scheme
I'm writing a level for a game in which the player has an advantage if they know a password. I want it to be infeasible to find the password from looking at the level's source code.
The problem is ...
- 123
-2
votes
4
answers
895
views
Roll your own encryption - with a twist
I am familiar with Schneier's Law:
Any person can invent a security system so clever that he or she can't imagine a way of breaking it.
I have read the many posts on this exchange littered with ...
- 21
2
votes
0
answers
83
views
Distributed Shared Secret for RNG that only Distributor knows?
For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
- 1,489
1
vote
1
answer
407
views
Is This DIY Password Authentication Scheme Acceptable?
This is mostly a thought experiment for client/server communication, and I want to know the flaws.
When a user account is created (with U as the username and P as the password,) I generate a random ...
- 113
6
votes
2
answers
901
views
What are the weaknesses of my authentication scheme?
So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
- 61
1
vote
1
answer
254
views
is this data encryption scheme viable?
My goal is to be able to encrypt the data so that no one would be able to make use of it if it was stolen.
User data
- the one that will be encrypted
- can be any type of data
Data encryption key
- ...
- 113
3
votes
1
answer
955
views
What is this QR code authentication scheme called?
What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more
A user is authenticated within webapp ...
- 253
0
votes
1
answer
4k
views
Where can I find a list of Indicators of Compromise (IOC) conditions?
OpenIOC.org has several schemas defining Indicators of Compromise.
The Schema is defined here:
http://schemas.mandiant.com/2010/ioc/ioc.xsd
While under IndicatorItemContext/search says it is xs:...
- 161
3
votes
1
answer
866
views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
- 604
5
votes
1
answer
648
views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
- 169
10
votes
4
answers
515
views
Defense in depth vs low complexity - Balancing point?
I've asked a few questions relating to schemes for various security-related functions, and posited schemes to accomplish those goals. In the responses, I see a conflict between two fundamental ...
- 6,768
286
votes
11
answers
88k
views
Why shouldn't we roll our own?
Why shouldn't we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I'm ...
- 135k