Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
64
votes
8answers
118k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
2
votes
1answer
79 views

Is this key exchange algorithm secure and valid? [closed]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
1
vote
1answer
49 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
0
votes
0answers
37 views

Why is TLS called application-level protocol? [duplicate]

I read this paragraph from rabbitmq networking page: Clients communicate with RabbitMQ over the network. All protocols supported by the broker are TCP-based. Both RabbitMQ and the operating system ...
2
votes
1answer
58 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
-1
votes
2answers
51 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
7
votes
1answer
4k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
0
votes
0answers
28 views

Secure Peer-to-Peer Multicast Communication?

The problem: A single broadcaster needs to send a series of messages through a peer-to-peer mesh network such that only specific other pre-approved nodes can read them. The set of authorized receivers ...
4
votes
1answer
338 views

Secret Santa - implementation that does not require a participant to trust the server

In the Christmas spirit I read Cryptographic Secret Santa from MathOverflow, and then followed the link to another page titled Cryptographic Secret Santa. On this latter page the author explains an ...
20
votes
3answers
82k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
1
vote
0answers
67 views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
0
votes
1answer
149 views

How are USSD messages used and who could send them?

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree). There is a Wikipedia ...
2
votes
2answers
66 views

Trouble trying to understand SET protocol

This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
0
votes
1answer
65 views

Remote authentication with random number challenge vs timestamp?

Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot ...
26
votes
2answers
12k views

Which protocols exist for end-to-end encrypted group chat?

I am looking for existing protocols for a group chat with two things: End to end encrypted. Just what you would expect: messages are only decipherable by the chat members and message tampering is ...
20
votes
2answers
15k views

The inner workings of iMessage security?

This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
73
votes
16answers
14k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
6
votes
3answers
1k views

Patent free symmetric-only key exchange protocols?

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
3
votes
0answers
54 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
34
votes
2answers
37k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
0
votes
0answers
48 views

In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?

When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
0
votes
1answer
50 views

Security element that relate to breaking protocol

I am working on evaluating an unsecure protocol. I am trying to categorize the vulnerabilites according to some commonly accepted security elements like the ones specified in the CIA triad or the ...
22
votes
5answers
4k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
0
votes
2answers
652 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? Is ...
3
votes
1answer
65 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
0
votes
1answer
51 views

Is there such a thing as an Authenticated Protocol?

I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
2
votes
1answer
444 views

Is there any open source SDK for implementing a KMIP server?

Is there any reputable open source SDK for implementing an OASIS Key Management Interoperability Protocol (KMIP) server?
7
votes
1answer
5k views

What are non-standard ports and protocols [closed]

I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, ...
1
vote
1answer
31 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
1
vote
1answer
554 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
1answer
205 views

How does the KeeLoq block cipher work?

Note: This question is follow-on from comments on this answer that were broad enough to be a separate question. As far as I understand, KeeLoq is a block cipher designed for use in the automotive ...
-1
votes
2answers
132 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any formulation/...
1
vote
0answers
33 views

Formal verification of security protocols

When you try to verify security protocols you have to do a lot of different steps like formalizing a simpler version based on a extremely complex real protocol using some extended Dolev Yao model. ...
3
votes
1answer
140 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
1
vote
3answers
232 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
11
votes
2answers
9k views

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

In BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C], page 372, there is a section called LE Security Modes, which states: There are two LE security modes, LE security mode 1 and LE security mode ...
10
votes
1answer
703 views

Why does TLS 1.3 deprecate custom DHE groups?

According to the second draft of the TLS 1.3 specification, custom DH groups have been deprecated. As we all know, hardcoded DH groups are vulnerable to a precomputation attack that allows retroactive ...
-1
votes
1answer
60 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
6
votes
2answers
341 views

Two generals' agreement

I am trying to figure an agreement protocol on an unreliable channel. Basically two parties (A and B) have to agree to do something, so it's the two generals' problem. Since there is no bullet-proof ...
1
vote
0answers
40 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
62 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
1
vote
1answer
64 views

Are there other methods than fuzzing for black box?

I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
1
vote
1answer
56 views

NAS with a public IP and multiple file sharing services – security concerns

I've ‘inherited’ (it's now my responsibility to take care of it) a WD My Cloud EX2 with a public IP and since it's exposed to the internet, I want to make sure that the data and other machines on the ...
2
votes
1answer
87 views

Are there techniques or methods to develop security protocols without side channel attacks?

In general timing attacks are a manifestation of the implementation. So if I am processing data on the server or the client then I can leak information depending on how the code is written. To ...
0
votes
1answer
100 views

Is it possible to become infected with virus, trojan or malware by browsing the infected sites or running installation .exe?

I am quite paranoid and I am always afraid that when i accidentally open some infected sites it would run scripts that automatically download malwares, viruses and trojans into my pc and run by ...
2
votes
0answers
28 views

Multi Party Protocol - Proof with semi-honest adversaries

I have designed a protocol where one entity acts as a "client", sends information to one of many "server-parties". This second party sends some other information to another "server-party" and so on, ...
1
vote
1answer
1k views

Where exactly in the OSI model does TLS/SSL belong [duplicate]

I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange, While all network models are imperfect, this question can only be answered by looking ...
2
votes
1answer
121 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
5
votes
1answer
2k views

MQTT over TLS using RabbitMQ

We want to use RabbitMQ over TLS for our mqtt messaging, so we did some testing and managed to get it working over port 8883 using this configuration guide and we need to connect on a url that starts ...
4
votes
1answer
174 views

Simple File Transfer Protocol

My SIEM has produced something intriguing. I went looking for unauthorized SSH connections, and looked for the SFTP protocol by mistake. I found a Windows web server that is connecting from port 80 to ...