Questions tagged [protocols]
A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.
305
questions
0
votes
0answers
45 views
OpenSSH v2 Protocol Explanation
I've been searching high and low, trying to find a easily digestible protocol flow of SSH v2.
Does anyone have any docs or, could someone give me an example flow?
I'm interested in the flow of the ...
0
votes
4answers
188 views
Should I disable TLS 1.0 and TLS 1.1 support on my web servers
Currently, my webserver support
TLS 1.0
TLS 1.1
TLS 1.2
One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till ...
0
votes
0answers
68 views
WiFi Router, current status of security options?
I'm about to buy a new WiFi router tomorrow (probably) & I'm wondering what kind of security features I should choose (Like: AES, WPA2, DMZ, TKIP, SPI, ...)
What is the current status of what is ...
1
vote
1answer
86 views
What is the problem with developing secure protocol on top of communication protocol without binding
I read that developing a security layer on top of communication protocol without any binding between them could cause an issue like MITM attack. I am having a hard time seeing how that could be ...
0
votes
0answers
33 views
Does a 2-party decentralized consensus protocol exist?
Assume there are 2 people in a conversation. Each one may support a given stance on an issue (the support is binary, either agreement=1, or disagreement=0). Both want to find more like-minded ...
2
votes
1answer
58 views
What is extension intolerance in the context of TLS?
SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
1
vote
1answer
72 views
Cardholder info transmission between issuing and acquiring banks
Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction?
Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
1
vote
1answer
53 views
SSH and the ECDH component
With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.
I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
0
votes
0answers
56 views
Is this symmetric key system secure?
I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme.
Secrets
The secret is a password that is known to both clients. This ...
1
vote
0answers
32 views
Advantages of EAP Authenticator in EAP protocol
What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
2
votes
1answer
80 views
Does the SSL record protocol encrypt the handshake protocol too?
As I know the first communication protocol which establishes between client and server in SSL is handshaking protocol and as this site says:
The SSL record protocol is used to transfer any data ...
0
votes
1answer
68 views
Thought process on Network Protocol Attack
I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion:
Since ...
2
votes
1answer
83 views
Is this key exchange algorithm secure and valid? [closed]
I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
1
vote
1answer
52 views
What protocols are authenticated by Active Directory?
Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
0
votes
0answers
51 views
Why is TLS called application-level protocol? [duplicate]
I read this paragraph from rabbitmq networking page:
Clients communicate with RabbitMQ over the network. All protocols supported by the broker are TCP-based. Both RabbitMQ and the operating system ...
2
votes
1answer
64 views
Access Control Lists - Why block a port rather than block a protocol?
I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example:
"if you want to block HTTP traffic,...
-1
votes
2answers
69 views
technical difference between TLS and a certificate [duplicate]
I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
0
votes
0answers
36 views
Secure Peer-to-Peer Multicast Communication?
The problem: A single broadcaster needs to send a series of messages through a peer-to-peer mesh network such that only specific other pre-approved nodes can read them. The set of authorized receivers ...
1
vote
0answers
174 views
Open source KMIP Server in a production-level environment [closed]
I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
1
vote
3answers
113 views
Remote authentication with random number challenge vs timestamp? [closed]
Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot ...
3
votes
0answers
60 views
Good book detailing the security aspects of Microsoft Active Directory [closed]
I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
81 views
In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?
When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
0
votes
1answer
51 views
Security element that relate to breaking protocol
I am working on evaluating an unsecure protocol. I am trying to categorize the vulnerabilites according to some commonly accepted security elements like the ones specified in the CIA triad or the ...
3
votes
1answer
67 views
Verifying Security of a Custom Network Protocol
I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
0
votes
1answer
51 views
Is there such a thing as an Authenticated Protocol?
I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
1
vote
1answer
35 views
Criteria for selecting fields and network protocols for fuzzing
I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification.
...
2
votes
2answers
74 views
Trouble trying to understand SET protocol
This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
1
vote
1answer
354 views
How does the KeeLoq block cipher work?
Note: This question is follow-on from comments on this answer that were broad enough to be a separate question.
As far as I understand, KeeLoq is a block cipher designed for use in the automotive ...
1
vote
1answer
771 views
OAuth 2.0 when and how to use the client id and secret
The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
0answers
34 views
Formal verification of security protocols
When you try to verify security protocols you have to do a lot of different steps like formalizing a simpler version based on a extremely complex real protocol using some extended Dolev Yao model. ...
3
votes
1answer
202 views
How do I know that the request and response is using encryption protocols in burp suite?
I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
-1
votes
1answer
61 views
What are the flaws in this security protocol between client and server? [closed]
Here is my security protocol for the use of a service provided by server. It utilises a symmetric key:
Client requests to use a service
Server sends back nonce
Client sends back nonce encrypted with ...
1
vote
3answers
253 views
Why is it required to HMAC riv in HDCP 2.3?
In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)).
Why is it required? Does it prevent any attack?
1
vote
0answers
40 views
Kerberos Protocol Centralized Server
If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
65 views
Provide email author origin integrity [closed]
If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
68 views
Are there other methods than fuzzing for black box?
I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
1
vote
1answer
63 views
NAS with a public IP and multiple file sharing services – security concerns
I've ‘inherited’ (it's now my responsibility to take care of it) a WD My Cloud EX2 with a public IP and since it's exposed to the internet, I want to make sure that the data and other machines on the ...
0
votes
1answer
108 views
Is it possible to become infected with virus, trojan or malware by browsing the infected sites or running installation .exe?
I am quite paranoid and I am always afraid that when i accidentally open some infected sites it would run scripts that automatically download malwares, viruses and trojans into my pc and run by ...
2
votes
0answers
28 views
Multi Party Protocol - Proof with semi-honest adversaries
I have designed a protocol where one entity acts as a "client", sends information to one of many "server-parties". This second party sends some other information to another "server-party" and so on, ...
0
votes
1answer
215 views
How are USSD messages used and who could send them?
Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree).
There is a Wikipedia ...
1
vote
1answer
2k views
Where exactly in the OSI model does TLS/SSL belong [duplicate]
I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange,
While all network models are imperfect, this question can only be
answered by looking ...
2
votes
1answer
122 views
Slow Hashing Without a Salt?
I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
2
votes
1answer
732 views
Is there any open source SDK for implementing a KMIP server?
Is there any reputable open source SDK for implementing an OASIS Key Management Interoperability Protocol (KMIP) server?
3
votes
1answer
291 views
What is httpvh:// and is it the result of something malicious?
I was working on a client's old website and I noticed that some of their YouTube links were broken and looked like this:
httpvh://www.youtube.com/watch?v=jNQXAC9IVRw
At first I assumed it was some ...
4
votes
1answer
195 views
Simple File Transfer Protocol
My SIEM has produced something intriguing. I went looking for unauthorized SSH connections, and looked for the SFTP protocol by mistake. I found a Windows web server that is connecting from port 80 to ...
2
votes
1answer
69 views
Does EAP exist as an independent authentication protocol, or just as a framework?
Does EAP exist as an authentication protocol itself, or will it only be found implemented as one of its methods (EAP-TLS, EAP-TTLS, etc)?
If EAP is only a framework, what additional detail do its ...
0
votes
1answer
270 views
What does a secure path mean?
I saw it in a slide for Mark Stamp. He says:
"Authentication on a stand-alone computer is relatively simple: 1) For
example, hash a password with a salt. 2) “Secure path,” attacks on
...
91
votes
10answers
21k views
Does it improve security to use obscure port numbers?
I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
-6
votes
1answer
430 views
LTE Security: What kind of cryptograpy could be used to fix layer 2? [closed]
New attacks on LTE:
https://thehackernews.com/2018/06/4g-lte-network-hacking.html
https://www.alter-attack.net/media/breaking_lte_on_layer_two.pdf
Layer two (data link) does not guarantee the ...
0
votes
1answer
48 views
Trustable Sources For Security Algorithms and Standards?
I am learner of cryptographic algorithms and security standards. I usually Google it to understand the basics of the algorithm or the protocol, and to find an implementation of a protocol. However I ...
