Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
1
vote
0answers
150 views

Known insecure IoT devices [closed]

I would like to create my own twist on intelligent home using various IoT devices. My goal is to try and pentest said devices in real-life-like scenerios. I'd like to cover various popular protocols ...
3
votes
2answers
557 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
2
votes
2answers
335 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
2
votes
2answers
1k views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
-2
votes
1answer
617 views

Is rolling your own network protocol insecure? [closed]

By now, everyone on here should know that rolling your own crypto is bad. But what's about rolling your own (encryption supporting) network protocol? I'm working on an open-source project (by now it'...
-4
votes
1answer
415 views

What are the best tools available in order to reverse engineer a communication protocol? [closed]

What are the best tools available in order to reverse engineer a communication protocol?
4
votes
0answers
137 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
1answer
606 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
0
votes
1answer
93 views

How secure is this security protocol? [closed]

I'm developing an application that will encrypt a bunch of files the client has on their machine and then send them to a server, to back them up. I need to encrypt the files so that other clients/...
13
votes
1answer
1k views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
3
votes
2answers
16k views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
6
votes
2answers
350 views

Biometric device instead of password - signature security

Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there ...
3
votes
1answer
8k views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
-1
votes
1answer
2k views

What is the meaning of “www-ssl” in the URL https://www-ssl.intel.com/? [closed]

While browsing INTEL website I came across the following link https://www-ssl.intel.com/content/www/in/en/data-center/new-center-of-possibility.html?cid=sem63p45119g-c&intel_term=intel%...
8
votes
1answer
2k views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
1answer
239 views

Detect if AES and hmac keys are invalid

I have a server which has a configured value of AES and HMAC key. The client also should have the same keys. When the client sends a request, the server interprets this request and reads the message. ...
0
votes
0answers
70 views

Ensure that a file can only be decrypted after a specific condition is not present

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted when a specific condition is not present (I ...
1
vote
0answers
82 views

How to decrypt a file only if specific conditions are not met [closed]

I know how to decrypt a file after one or more specific environnemental conditions are met (with secure triggers). I am interested in a cryptographic sheme that would enable decryption of data only ...
-1
votes
2answers
139 views

What is the best formal method to prove the privacy (anonymity) of a security protocol

I am studying about TOR. I require to formally verify that the involved protocols provide anonymity. However, I could not find a suitable formalism of anonymity. If there exist any formulation/...
0
votes
1answer
43 views

How to interpet RFC data format

I'm having slight problems reading the used format in an Internet-Draft: TokenBindingProtocol#Section6 here enum { provided_token_binding(0), referred_token_binding(1), (255) } TokenBindingType; ...
10
votes
2answers
477 views

Are there any meta-formats for crypto?

Are there are any (properly specified) meta-formats / schema formats for describing cryptographic message structures? I'm looking for a way to describe the format (where some channels might want ...
2
votes
2answers
393 views

Is SSL over HIP (Host Identity Protocol) possible?

In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol: Identifier/Locator Split for Host Mobility and Multihoming it is stated Most Internet applications can run ...
2
votes
0answers
588 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 (...
75
votes
16answers
15k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
0
votes
2answers
141 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
10
votes
2answers
4k views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
0
votes
1answer
37 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
2
votes
0answers
38 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
3
votes
2answers
3k views

Is Chromecast's UPnP requirement “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security is ...
10
votes
1answer
7k views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
2
votes
1answer
585 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
2
votes
1answer
841 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
10
votes
3answers
8k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
3
votes
1answer
131 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
1
vote
0answers
152 views

How to use reflection attack in this simple protocol?

The following mutual authentication protocol has been designed to be resilient against reflection attacks. This is done by ensuring that the challenge from the initiator looks different from the ...
28
votes
10answers
4k views

Why can protocols on higher layers be left unchanged?

In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works: SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also ...
1
vote
2answers
2k views

What makes an SMS gateway insecure?

Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere ...
1
vote
1answer
10k views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
3
votes
2answers
8k views

can wpa2 wifi be hacked by capturing data on an evil twin?

If I copied the wifi essid and channel and did a de-authentication to the clients of the wifi that I want to hack and started a wifi of my own with the same essid, bssid and channel and I started ...
1
vote
2answers
87 views

“Secure” drawing of lots [closed]

I want to randomly choose a game in the 50 games I have, in order to play with one of my friend. But this friend doesn't trust me, and neither do I: every time one of us pick up a game, the other ...
0
votes
1answer
770 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
-8
votes
5answers
268 views

Is SSL more secure than encoding?

I am writing a client / server program pair. I have established my own protocol and am communicating with TCP. Presently, when the client messages the server, it adds 42 to each byte (looping, 127 + 1 ...
47
votes
3answers
4k views

Is Git crowdsourcing cryptographic attacks?

A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed ...
3
votes
1answer
8k views

Which forward secrecy cipher suites are supported for TLS1.0 protocols?

May I know which are all forward secrecy ciphers supported in TLSv1.0 protocols?
1
vote
2answers
2k views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
1
vote
2answers
129 views

Is there a protocol for securely trading information between possibly uncooperating agents?

Is there a protocol or best practice for trading information between parties where one, after receiving his share of the information from the others, might refuse to answer or might alter his answer, ...
1
vote
0answers
405 views

Mutual Authentication Protocol based on MAC & shared secret key

I am quite unsure about how to approach this question, was wondering if anyone could give me a nudge in the right direction, I would be most appreciative! So I've learned about the 4-way handshake ...
5
votes
1answer
366 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
6
votes
2answers
3k views

In a browser web server communication, who decides which encryption protocol to use [duplicate]

My IE browser has SSLv3.0, TLS 1.0,1.1 and 1.2 enabled in the advanced settings. And (I was informed by my server admin) my web server can encrypt data in SSLv3.0 and TLS 1.0 Now which system (...
3
votes
1answer
168 views

Masking traffic in another protocol

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If ...

1 2 3
4
5
7