Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
3
votes
1answer
718 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
334 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
26
votes
6answers
6k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
0
votes
1answer
156 views

In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks?

I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my ...
2
votes
2answers
136 views

Good publicly available unpredictable random number sources?

I wasn't sure whether to ask this on crypto or security, but since it involves real-world trust and services, I figured this is the better place. Consider that me and my friends (whom for the ...
1
vote
4answers
2k views

SSL Protocol Support

If I connect to a server using a specific SSL protocol version, but no cipher-suites are offered under that protocol, would that protocol still be considered supported? For example, connecting to a ...
2
votes
1answer
515 views

Can CMP (Certificate Management Protocol) be used to issue certificates to mobile devices?

The SCEP (Simple Certificate Enrollment Protocol) is the more like the defacto protocol for device enrollment. It pushes the digital certificates to the device which can be used for authentication, ...
2
votes
1answer
1k views

GRE DDOS — Wouldn't the firewall block it?

So I've been reading up on Mirai. And I found out that it implements a rather unique attack, described here, where it floods the victim with GRE packets. GRE is IP protocol number 47. Now here's ...
11
votes
2answers
10k views

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

In BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C], page 372, there is a section called LE Security Modes, which states: There are two LE security modes, LE security mode 1 and LE security mode ...
2
votes
1answer
202 views

Which Extensible Provisioning Protocol (EPP) status-values provide sufficient protection against domain hijacking?

The Extensible Provisioning Protocol (EPP) as described in RFC 5730, can possibly be protective against domain hijacked. The protocol consists of the 17 following status-values as described in RFC ...
4
votes
3answers
576 views

Does QUIC really solved IP spoofing problem

Many documents indicates that in QUIC solves IP spoofing problem by a server generated token. Specifically, server issues a token so that the client can use it to identify itself, then the server will ...
1
vote
0answers
1k views

Different versions of TLS in record layer and handshake layer [duplicate]

There is application that uses OpenSSL 1.0.2g. Application is able to receive incoming connections and initiate outbound connection. Application sends ClientHello message during create outbound ...
3
votes
1answer
285 views

Is there an advantage in using separate key pairs for encryption and signing? [duplicate]

Let's assume that we are designing a binary protocol for message exchange between devices. Part of the message will be RSA encrypted and there will also be an RSA signature block in the message. Is ...
1
vote
1answer
171 views

Meterpreter connections

If i setup a meterpreter reverse_https payload and send to multiple targets and they execute the payload whithout my handler running, when I setup the handler will they connect or do I have to have ...
1
vote
1answer
40 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
1answer
249 views

Hex string in TLS SNI field

I'm looking at packet captures of TLS traffic, and I see TLS-encrypted connections where the SNI field contains a long hex string (a sequence of 64 hex nibbles) -- not a domain name. What might ...
1
vote
1answer
111 views

CMP - Simply get certificate, knowing some information

My company is migrating its CAs. Actually, it's Unicert CA using a UPI client. But in the future, they want a CA supporting CMP (it should be EJBCA, I'm actually testing this). So I analyzed the ...
5
votes
1answer
2k views

MQTT over TLS using RabbitMQ

We want to use RabbitMQ over TLS for our mqtt messaging, so we did some testing and managed to get it working over port 8883 using this configuration guide and we need to connect on a url that starts ...
0
votes
1answer
1k views

TLS1.0 to TLS1.2 (Browser vs Registry)

Question How does TLS protocol differ on registry and browser level? Context Many companies are migrating from protocol TLS1.0 (disabling this) to TLS1.2 (enabling it). I'm not sure how this ...
1
vote
1answer
1k views

Restrict cipher suites within specific protocol versions

I need to disable the weak ciphers within a weak protocol version, namely TLS1.0, on a windows server 2012 R2 running IIS. I understand that cipher suites are tied to protocol, i.e. ...
3
votes
2answers
461 views

Best practices for connecting USB key to secure computer?

This is a bit of a hypothetical, but I am interested in an answer. First, I understand that no one can protect themselves against three letter organizations, so I am really just wondering about best ...
1
vote
1answer
668 views

Which of the TLS ciphersuites are more faste and secure in Handshaking?

I know "SSL 3.0" and TLS 1.0 have weakness security, because using of "RC4" cipher. instead it, "TLS 1.2" have more security, now I want to use of a fast ciphersuite and a complicated handeshake ...
1
vote
1answer
152 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
33
votes
2answers
17k views

Which protocols exist for end-to-end encrypted group chat?

I am looking for existing protocols for a group chat with two things: End to end encrypted. Just what you would expect: messages are only decipherable by the chat members and message tampering is ...
-1
votes
1answer
163 views

Map of Protocols to Encryption/Cipher Suite

I am looking for a mapping of all protocols (HTTPS, SCP, SFTP, LDAP, RDP, ect) along with the Encryption Protocols that can be used with them (SSH, SSL/TLS, ect) and if possible their Cipher Suites (...
0
votes
2answers
814 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? Is ...
0
votes
2answers
288 views

SSL protocol analysis

1) What is the use of Cert B in this protocol? 2) What does it prove to Alice? 3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key ...
1
vote
1answer
559 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
1
vote
0answers
205 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
3
votes
0answers
79 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
1
vote
0answers
1k views

Is the QUIC protocol secure?

QUIC is a new protocol for video streaming, that can establish a secure connection in one round. It is used in Google's new Duo app for example. How does it work and is it secure (comparison with TCP ...
6
votes
1answer
219 views

What is the serious security flaw with this authentication protocol?

I've been asked to solve this security problem, as an exercise, but I have some difficulties. Some notation: C1 means Computer1 S1 means Server1, TA means Trusted Autentication system, X -> Y | Z ...
4
votes
1answer
140 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
2
votes
1answer
468 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
1
vote
2answers
59 views

Dynamic, Randomized Protocols to Deter Attackers

Imagine a protocol that changed periodically. What if the order of these fields were changed a lot? One point in time the protocol might be { Payload, Checksum, Length, Flags, ID } The next point in ...
3
votes
1answer
621 views

What are active research topics in SSL/TLS?

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here. I am interested in doing ...
0
votes
1answer
192 views

Is there security in the 1-wire protocol?

I know that the 1-wire protocol has a slower communication and that it can be physically accessible and there other ways to get the information from the data bus. I can't seem to find much ...
2
votes
2answers
123 views

Why do ALGs restrict traffic on a given TCP port based on the protocol?

My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
4
votes
3answers
2k views

Which are the most important RFCs when learning security? [closed]

I was reading some security related blogs and write ups in internet and I started going for the RFCs instead, but they are huge, therefore impossible to learn all of them. I see those below as very ...
1
vote
0answers
359 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
0
votes
2answers
169 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
10
votes
1answer
139 views

SSL 3.0 for clients without room for chosen plaintext attacks

I've collected the issues that affect SSL 3.0 and found that they are either configuration issues (disabling RC4, RC2, DES, anon, export, null suites, compression, proper key lengths, etc.) or ...
0
votes
0answers
91 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
12
votes
3answers
2k views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
-2
votes
1answer
316 views

Is it possible to build unbreakable Protocol Obfuscation? [closed]

Using Protocol Obfuscation some internet protocols have tried to evade traffic shaping. BitTorrent supports Protocol Obfuscation for instance. Is it possible to build unbreakable Protocol Obfuscation?...
7
votes
2answers
746 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said disclaimer,...
1
vote
1answer
323 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According to ...
3
votes
2answers
2k views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
34
votes
3answers
93k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
1answer
150 views

Security Protocol Notation Editor [closed]

Are there any editors or tools that support the secure protocol notation?

1 2
3
4 5
7