Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
0
votes
1answer
50 views

Defending against Wiegand sniffing (ESPKey) attacks in RFID card readers

It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their ...
0
votes
0answers
17 views

Who provides prime numbers for cryptographic protocols? [migrated]

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
1
vote
3answers
1k views

Which protocol should I use for secure message transfers between two servers?

There are two servers. I am going to transfer very secret messages from the first one to the second. The second server (the one that receives data) doesn't have access to any other resources except ...
0
votes
1answer
108 views

Can I elicit responses from “any remote host” on “all protocols” if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
1
vote
1answer
77 views

Deauth not working on a certain network and I want to understand why

I've done some research for the past hour but I can't find a definitive answer to what is happening. So I use a AWUS036NHA, put it in monitor mode, sniff everything, then sniff the AP I want to do ...
1
vote
1answer
107 views

Can using web-based protocol handlers for protocols such as mailto: links be dangerous in any way?

My question is specifically about an option in Google Chrome under Settings > Site Settings > Handlers. I've read in the past that with desktop-based protocol handlers--such as Office Outlook or ...
0
votes
0answers
53 views

What encryption protocol is Kleopatra using to protect the private key?

What encryption protocol is Kleopatra using to protect the private key? I checked PGP RFC document and found out different protocols can be used, it's up to the software developer. Has anyone be able ...
0
votes
1answer
277 views

How are USSD messages used and who could send them?

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree). There is a Wikipedia ...
10
votes
1answer
1k views

Why does TLS 1.3 deprecate custom DHE groups?

According to the second draft of the TLS 1.3 specification, custom DH groups have been deprecated. As we all know, hardcoded DH groups are vulnerable to a precomputation attack that allows retroactive ...
0
votes
0answers
35 views

TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake

I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3. I have configured in both systems the list of allowed ciphersuites: ...
0
votes
1answer
53 views

Performing a simpler ssl handshake [duplicate]

Consider the following scenario: client sends hello server send a hello and its certificate client generates a key and encrypts that with server's public key server decrypts the key with its private ...
11
votes
2answers
7k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
29
votes
2answers
14k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
4
votes
3answers
2k views

Which are the most important RFCs when learning security? [closed]

I was reading some security related blogs and write ups in internet and I started going for the RFCs instead, but they are huge, therefore impossible to learn all of them. I see those below as very ...
0
votes
2answers
138 views

How Wifi prevent hacking in the same network?

We all know that the client device and WiFi AP will perform the 4 way handshake to generate the session key (PTK). Here is the recap of the 4 way handshake. 1.Client device<-----ANonce-----WiFi AP ...
26
votes
6answers
6k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
0
votes
2answers
106 views

How do I write my own authentication protocol and add that to OpenWrt? [closed]

I would like to add a ticket based authentication mechanism to my network. Can you give me brief idea where do I start, which language should i write the protocol in and how do i get those in my ...
0
votes
0answers
20 views

How do I implement a token based authentication system in a mesh network?

In this i would like to build a token based system where the MAP(mesh access point) generates a token for verified client and that token can be used for seamless handoff when the client travels from ...
3
votes
2answers
3k views

Is Chromecast's UPnP requirement “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security is ...
0
votes
1answer
103 views

WiFi Router, current status of security options?

I'm about to buy a new WiFi router tomorrow (probably) & I'm wondering what kind of security features I should choose (Like: AES, WPA2, DMZ, TKIP, SPI, ...) What is the current status of what is ...
4
votes
1answer
440 views

Secret Santa implementation that does not require a participant to trust the server

In the Christmas spirit I read Cryptographic Secret Santa from MathOverflow, and then followed the link to another page titled Cryptographic Secret Santa. On this latter page the author explains an ...
0
votes
2answers
112 views

Can an ISP block BitTorrent peer discovery but not file transfer?

When I start new torrents, I find there is no traffic for hours. I switch to another network (a cellular data hotspot) and the torrents start flowing. I return to my usual network, and the torrents ...
34
votes
3answers
93k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
1
vote
0answers
48 views

Detect use a private key by more than one or by someone other than the owner [closed]

I'm designing a protocol over the SSL but I faced a challenge. In the network each user takes a private key from authority. I want to just the owner can use his/her the private key. there are two ...
2
votes
3answers
4k views

Should I disable TLS 1.0 and TLS 1.1 support on my web servers

Currently, my webserver support TLS 1.0 TLS 1.1 TLS 1.2 One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till ...
1
vote
1answer
94 views

What is the problem with developing secure protocol on top of communication protocol without binding

I read that developing a security layer on top of communication protocol without any binding between them could cause an issue like MITM attack. I am having a hard time seeing how that could be ...
0
votes
0answers
34 views

Does a 2-party decentralized consensus protocol exist?

Assume there are 2 people in a conversation. Each one may support a given stance on an issue (the support is binary, either agreement=1, or disagreement=0). Both want to find more like-minded ...
10
votes
4answers
2k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks unique ...
2
votes
1answer
89 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
1
vote
1answer
80 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
36
votes
2answers
41k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
33
votes
2answers
17k views

Which protocols exist for end-to-end encrypted group chat?

I am looking for existing protocols for a group chat with two things: End to end encrypted. Just what you would expect: messages are only decipherable by the chat members and message tampering is ...
36
votes
6answers
24k views

Preventing artificial latency or “Lag Hacking” in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
1
vote
1answer
91 views

SSH and the ECDH component

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication. I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
0
votes
0answers
61 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
1
vote
3answers
176 views

Remote authentication with random number challenge vs timestamp? [closed]

Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot ...
1
vote
0answers
67 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
2
votes
2answers
86 views

Trouble trying to understand SET protocol

This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
2
votes
1answer
151 views

Does the SSL record protocol encrypt the handshake protocol too?

As I know the first communication protocol which establishes between client and server in SSL is handshaking protocol and as this site says: The SSL record protocol is used to transfer any data ...
0
votes
1answer
71 views

Thought process on Network Protocol Attack

I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion: Since ...
66
votes
8answers
129k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
3
votes
1answer
101 views

Is this key exchange algorithm secure and valid? [closed]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
1
vote
1answer
54 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
2
votes
1answer
81 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
-1
votes
2answers
95 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
21
votes
3answers
87k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
4
votes
0answers
869 views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
20
votes
2answers
16k views

The inner workings of iMessage security?

This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
75
votes
16answers
15k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
6
votes
3answers
1k views

Patent free symmetric-only key exchange protocols?

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...

1
2 3 4 5
7