Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
119 views

Kerberos protocol attacks?

I have a question in my mind regarding the inner workings of Kerberos protocol. If the generation of the session key is somehow insecure, does this compromise the security of the Kerberos protocol? I ...
meta_warrior's user avatar
0 votes
0 answers
50 views

How can Trudy attack the protocol where both Alice and Bob complete authentication and Trudy gets the session key?

I'm studying up protocols, authentication and attacks for a class I'm taking, but I've encountered a question that I just cannot figure out. If Alice and Bob have the below protocol and the session ...
HeatherWeatherNever88's user avatar
0 votes
3 answers
155 views

Need for authentication in an offline system

I need to design a scheme, where access to an offline System is granted based on some kind of information/proof of knowledge, provided by a separete system, Prover system. I'm in position where I can ...
pwes's user avatar
  • 111
1 vote
0 answers
96 views

Any vulnerability of OCSP for proof of concept

I have an assignment in which I have to implement OCSP and do a proof of concept of a vulnerability. My idea was to implement OCSP without using a nonce (this is done) and then perform a replay attack....
Pedro's user avatar
  • 11
0 votes
0 answers
125 views

How long does Signal keep the keys for out-of-order messages?

I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
user2600798's user avatar
1 vote
2 answers
249 views

Can a VPN connection be detected (and get blocked) even after the key exchange happens

If the key exchange happens when using lets say Wireguard or any other protocols that use IKA, and the connection never drops, could the ISP still detect the VPN traffic using Deep Packet Inspection?
Emily1001's user avatar
0 votes
1 answer
149 views

Why is this simple encryption protocol not enough for messaging?

Signal Messenger is basically state of the art chat when it comes to security and privacy: It uses only phone numbers for user identification, doesn't store user chat and the encryption protocol is ...
Angelica's user avatar
2 votes
2 answers
252 views

Does any real world protocol makes use of the associated data in AEAD?

I'm trying to find evidence of use of the associated data (authenticated cleartext associated with the encrypted and authenticated data) feature offered by AEAD (Authenticated Encryption with ...
Bruno Rohée's user avatar
  • 5,477
1 vote
0 answers
84 views

How to evaluate a responsive but unknown network protocol?

I am studying CREST CPSA where the syllabus is listed here. There is a part of the syllabus which states I should know the Evaluation of responsive but unknown network applications. I find this ...
questioner's user avatar
1 vote
1 answer
93 views

Why is the authentication server needed in the Kerberos protocol

Consider the diagram in https://en.wikipedia.org/wiki/Kerberos_(protocol)#/media/File:Kerberos_protocol.svg depicting the Kerberos protocol. I'm wondering how the authentication server (AS) is useful.....
user2224350's user avatar
0 votes
0 answers
60 views

Usage of HMACs to verify the licensing during production

We have a production that uses our software (put on a chip) and a requirement that we need to limit the amount of chips produced for each customer (so they need to buy a license) - so they can't ...
Archeg's user avatar
  • 101
9 votes
9 answers
4k views

Can proprietary protocols be considered as secured?

I am new to the info-sec industry and was recently tasked with evaluating the communication protocols used by my various subsystems. So it was stated in the requirements that the systems have to ...
Lucas's user avatar
  • 99
1 vote
3 answers
639 views

Standard for encrypt files before transfer them over internet

I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers. Encrypting files using PGP is a way to encrypt files ...
VSB's user avatar
  • 185
1 vote
1 answer
1k views

Could someone the real IP address when using tunnel protocols like ngrok, localtunnel or serveo?

Could someone get the real IP address that is hidden behind the URL generated by tools like ngrok, localtunnel or serveo?
thecow milk's user avatar
0 votes
1 answer
105 views

Should I be seeing network management protocols on 'user' subnets?

When performing a passive packet capture of a network, I have seen a large amount of traffic being broadcast using different protocols. These protocols are primarily used to perform some kind of ...
NULLZ's user avatar
  • 11.5k
17 votes
2 answers
4k views

Can my ISP see which VPN protocol I am using?

I know that my ISP can detect when I am using a VPN, but can it see which protocol I am using?
E. M.'s user avatar
  • 171
1 vote
1 answer
307 views

Why isn't U2F's CTAP protocol forwards-compatible with FIDO2's CTAP protocol?

I've been trying to find the major differences between "U2F" versus "FIDO2" two-factor authentication standards. Reading some of the articles posted by different companies and even ...
natevw's user avatar
  • 131
1 vote
3 answers
1k views

Defending against Wiegand sniffing (ESPKey) attacks in RFID card readers

It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their ...
user3207874's user avatar
0 votes
1 answer
950 views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
Freddy Nova's user avatar
0 votes
0 answers
92 views

TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake

I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3. I have configured in both systems the list of allowed ciphersuites: ...
Silverman's user avatar
  • 101
0 votes
1 answer
148 views

Performing a simpler ssl handshake [duplicate]

Consider the following scenario: client sends hello server send a hello and its certificate client generates a key and encrypts that with server's public key server decrypts the key with its private ...
FIFO's user avatar
  • 13
0 votes
2 answers
348 views

How Wifi prevent hacking in the same network?

We all know that the client device and WiFi AP will perform the 4 way handshake to generate the session key (PTK). Here is the recap of the 4 way handshake. 1.Client device<-----ANonce-----WiFi AP ...
Alex Tse's user avatar
0 votes
2 answers
196 views

How do I write my own authentication protocol and add that to OpenWrt? [closed]

I would like to add a ticket based authentication mechanism to my network. Can you give me brief idea where do I start, which language should i write the protocol in and how do i get those in my ...
Tushar Malpani's user avatar
1 vote
2 answers
399 views

Can an ISP block BitTorrent peer discovery but not file transfer?

When I start new torrents, I find there is no traffic for hours. I switch to another network (a cellular data hotspot) and the torrents start flowing. I return to my usual network, and the torrents ...
Joshua Fox's user avatar
1 vote
1 answer
373 views

Can using web-based protocol handlers for protocols such as mailto: links be dangerous in any way?

My question is specifically about an option in Google Chrome under Settings > Site Settings > Handlers. I've read in the past that with desktop-based protocol handlers--such as Office Outlook or ...
jojo5389's user avatar
1 vote
0 answers
93 views

Detect use a private key by more than one or by someone other than the owner [closed]

I'm designing a protocol over the SSL but I faced a challenge. In the network each user takes a private key from authority. I want to just the owner can use his/her the private key. there are two ...
FIFO's user avatar
  • 13
2 votes
1 answer
435 views

Deauth not working on a certain network and I want to understand why

I've done some research for the past hour but I can't find a definitive answer to what is happening. So I use a AWUS036NHA, put it in monitor mode, sniff everything, then sniff the AP I want to do ...
okaz's user avatar
  • 21
8 votes
3 answers
18k views

Should I disable TLS 1.0 and TLS 1.1 support on my web servers

Currently, my webserver support TLS 1.0 TLS 1.1 TLS 1.2 One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till ...
Avery Lam's user avatar
0 votes
1 answer
168 views

WiFi Router, current status of security options?

I'm about to buy a new WiFi router tomorrow (probably) & I'm wondering what kind of security features I should choose (Like: AES, WPA2, DMZ, TKIP, SPI, ...) What is the current status of what is ...
Sebastian Norr's user avatar
1 vote
1 answer
139 views

What is the problem with developing secure protocol on top of communication protocol without binding

I read that developing a security layer on top of communication protocol without any binding between them could cause an issue like MITM attack. I am having a hard time seeing how that could be ...
RealTimeEngineer91's user avatar
2 votes
1 answer
214 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
Polynomial's user avatar
  • 134k
1 vote
1 answer
130 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
Alexander Shcheblikin's user avatar
1 vote
1 answer
508 views

SSH and the ECDH component

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication. I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
Woodstock's user avatar
  • 689
0 votes
0 answers
103 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
owacoder's user avatar
  • 197
1 vote
0 answers
231 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
AleWolf's user avatar
  • 109
2 votes
1 answer
363 views

Does the SSL record protocol encrypt the handshake protocol too?

As I know the first communication protocol which establishes between client and server in SSL is handshaking protocol and as this site says: The SSL record protocol is used to transfer any data ...
Kamran Hosseini's user avatar
0 votes
1 answer
115 views

Thought process on Network Protocol Attack

I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion: Since ...
Prashin Jeevaganth's user avatar
2 votes
1 answer
158 views

Is this key exchange algorithm secure and valid? [closed]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
Alexander Vtyurin's user avatar
1 vote
1 answer
117 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
aquaman's user avatar
  • 83
2 votes
1 answer
452 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
Jeremy P's user avatar
-1 votes
2 answers
188 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
user217484's user avatar
5 votes
0 answers
2k views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
Chris's user avatar
  • 51
1 vote
3 answers
502 views

Remote authentication with random number challenge vs timestamp? [closed]

Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot ...
caffein's user avatar
  • 131
3 votes
0 answers
108 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
JohnyD's user avatar
  • 169
0 votes
0 answers
493 views

In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?

When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
Jay Parekh's user avatar
0 votes
1 answer
91 views

Security element that relate to breaking protocol

I am working on evaluating an unsecure protocol. I am trying to categorize the vulnerabilites according to some commonly accepted security elements like the ones specified in the CIA triad or the ...
Tagor's user avatar
  • 125
3 votes
1 answer
131 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
user203621's user avatar
0 votes
1 answer
93 views

Is there such a thing as an Authenticated Protocol?

I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
Richard's user avatar
  • 21
1 vote
1 answer
93 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
lalu's user avatar
  • 145
2 votes
2 answers
128 views

Trouble trying to understand SET protocol

This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
John Katsantas's user avatar

1
2 3 4 5
7