Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
10
votes
4answers
2k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks unique ...
2
votes
1answer
52 views

What is extension intolerance in the context of TLS?

SSL Labs checks for TLS version intolerance and TLS extension intolerance. I've seen another answer on this site that covers version intolerance, but what does extension intolerance mean, specifically,...
1
vote
1answer
67 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
35
votes
2answers
37k views

What changed between TLS and DTLS

What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP? Bonus points: Do any of the protocol difference affect the way it should be used, both in terms of interface ...
30
votes
2answers
13k views

Which protocols exist for end-to-end encrypted group chat?

I am looking for existing protocols for a group chat with two things: End to end encrypted. Just what you would expect: messages are only decipherable by the chat members and message tampering is ...
36
votes
6answers
21k views

Preventing artificial latency or “Lag Hacking” in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
8
votes
1answer
5k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
1
vote
1answer
46 views

SSH and the ECDH component

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication. I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ...
0
votes
0answers
53 views

Is this symmetric key system secure?

I am creating a secure network data transfer system, and would like to know if there are any obvious flaws in this scheme. Secrets The secret is a password that is known to both clients. This ...
1
vote
3answers
108 views

Remote authentication with random number challenge vs timestamp? [closed]

Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot ...
4
votes
1answer
376 views

Secret Santa - implementation that does not require a participant to trust the server

In the Christmas spirit I read Cryptographic Secret Santa from MathOverflow, and then followed the link to another page titled Cryptographic Secret Santa. On this latter page the author explains an ...
1
vote
0answers
26 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
0
votes
1answer
196 views

How are USSD messages used and who could send them?

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree). There is a Wikipedia ...
2
votes
2answers
74 views

Trouble trying to understand SET protocol

This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
2
votes
1answer
70 views

Does the SSL record protocol encrypt the handshake protocol too?

As I know the first communication protocol which establishes between client and server in SSL is handshaking protocol and as this site says: The SSL record protocol is used to transfer any data ...
0
votes
1answer
68 views

Thought process on Network Protocol Attack

I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion: Since ...
65
votes
8answers
120k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
2
votes
1answer
83 views

Is this key exchange algorithm secure and valid? [closed]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
1
vote
1answer
52 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
0
votes
0answers
44 views

Why is TLS called application-level protocol? [duplicate]

I read this paragraph from rabbitmq networking page: Clients communicate with RabbitMQ over the network. All protocols supported by the broker are TCP-based. Both RabbitMQ and the operating system ...
2
votes
1answer
63 views

Access Control Lists - Why block a port rather than block a protocol?

I am studying for my Security + exam. I have just learned that ACLs can be designed to block ports and/or entire protocols. The book I am reading states an example: "if you want to block HTTP traffic,...
-1
votes
2answers
62 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
0
votes
0answers
30 views

Secure Peer-to-Peer Multicast Communication?

The problem: A single broadcaster needs to send a series of messages through a peer-to-peer mesh network such that only specific other pre-approved nodes can read them. The set of authorized receivers ...
20
votes
3answers
83k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
1
vote
0answers
115 views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
20
votes
2answers
15k views

The inner workings of iMessage security?

This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
73
votes
16answers
14k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
6
votes
3answers
1k views

Patent free symmetric-only key exchange protocols?

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
3
votes
0answers
57 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
74 views

In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?

When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
0
votes
1answer
50 views

Security element that relate to breaking protocol

I am working on evaluating an unsecure protocol. I am trying to categorize the vulnerabilites according to some commonly accepted security elements like the ones specified in the CIA triad or the ...
23
votes
5answers
5k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
0
votes
2answers
697 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? Is ...
3
votes
1answer
66 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
0
votes
1answer
51 views

Is there such a thing as an Authenticated Protocol?

I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
2
votes
1answer
648 views

Is there any open source SDK for implementing a KMIP server?

Is there any reputable open source SDK for implementing an OASIS Key Management Interoperability Protocol (KMIP) server?
7
votes
1answer
6k views

What are non-standard ports and protocols [closed]

I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, ...
1
vote
1answer
34 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
1
vote
1answer
709 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
1answer
309 views

How does the KeeLoq block cipher work?

Note: This question is follow-on from comments on this answer that were broad enough to be a separate question. As far as I understand, KeeLoq is a block cipher designed for use in the automotive ...
-1
votes
2answers
134 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any formulation/...
1
vote
0answers
34 views

Formal verification of security protocols

When you try to verify security protocols you have to do a lot of different steps like formalizing a simpler version based on a extremely complex real protocol using some extended Dolev Yao model. ...
3
votes
1answer
184 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
1
vote
3answers
247 views

Why is it required to HMAC riv in HDCP 2.3?

In HDCP 2.3 (pdf) during the Session Key Exchange, the HDCP transmitter sends also the 256-bit HMAC of riv (HMAC-SHA256(riv, kd)). Why is it required? Does it prevent any attack?
11
votes
2answers
9k views

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

In BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C], page 372, there is a section called LE Security Modes, which states: There are two LE security modes, LE security mode 1 and LE security mode ...
10
votes
1answer
768 views

Why does TLS 1.3 deprecate custom DHE groups?

According to the second draft of the TLS 1.3 specification, custom DH groups have been deprecated. As we all know, hardcoded DH groups are vulnerable to a precomputation attack that allows retroactive ...
-1
votes
1answer
61 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
6
votes
2answers
343 views

Two generals' agreement

I am trying to figure an agreement protocol on an unreliable channel. Basically two parties (A and B) have to agree to do something, so it's the two generals' problem. Since there is no bullet-proof ...
1
vote
0answers
40 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
64 views

Provide email author origin integrity [closed]

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?

1 2 3 4 5 6