Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
2
votes
2answers
72 views

Trouble trying to understand SET protocol

This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after ...
2
votes
1answer
469 views

Is there any open source SDK for implementing a KMIP server?

Is there any reputable open source SDK for implementing an OASIS Key Management Interoperability Protocol (KMIP) server?
2
votes
1answer
67 views

Does EAP exist as an independent authentication protocol, or just as a framework?

Does EAP exist as an authentication protocol itself, or will it only be found implemented as one of its methods (EAP-TLS, EAP-TTLS, etc)? If EAP is only a framework, what additional detail do its ...
2
votes
2answers
138 views

One way protocol with encryption without tcp

I am trying to brainstorm how I might either: 1) create a protocol (although against this option) 2) use an existing protocol That does the following: 1) allows 1 way communication from 1 node to ...
2
votes
1answer
87 views

Are there techniques or methods to develop security protocols without side channel attacks?

In general timing attacks are a manifestation of the implementation. So if I am processing data on the server or the client then I can leak information depending on how the code is written. To ...
2
votes
1answer
469 views

Can CMP (Certificate Management Protocol) be used to issue certificates to mobile devices?

The SCEP (Simple Certificate Enrollment Protocol) is the more like the defacto protocol for device enrollment. It pushes the digital certificates to the device which can be used for authentication, ...
2
votes
2answers
1k views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
2
votes
1answer
545 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
2
votes
1answer
152 views

Masking traffic in another protocol

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If ...
2
votes
1answer
392 views

What network protocol is Crashplan using?

I have been using CrashPlan for a while internally (i.e. local backup server). I would also like to setup off-site backup but my experience is that I have to forward a port from the router sitting at ...
2
votes
1answer
1k views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
2
votes
1answer
590 views

tshark - dump the data section

As the name suggests, im trying to dump the data section of the packet, man would suggest that its something like tshark -r file.pcap -t fields but im not having any luck
2
votes
1answer
374 views

Is it safe to store secrets in LDAP?

Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP. Is it safe to store secret or sensitive information as an ...
2
votes
2answers
120 views

TLS Extentions: Omitting TLS Handshake Messages

I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS ...
2
votes
2answers
130 views

Good publicly available unpredictable random number sources?

I wasn't sure whether to ask this on crypto or security, but since it involves real-world trust and services, I figured this is the better place. Consider that me and my friends (whom for the ...
2
votes
1answer
948 views

GRE DDOS — Wouldn't the firewall block it?

So I've been reading up on Mirai. And I found out that it implements a rather unique attack, described here, where it floods the victim with GRE packets. GRE is IP protocol number 47. Now here's ...
2
votes
1answer
725 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
2
votes
2answers
141 views

What steps remain for a robust, neutral and surveillance-proof Internet? [closed]

Recent leaks about widespread NSA surveillance have brought privacy and security to the forefront of the public consciousness as we strive to determine best practices in governance for the Internet ...
2
votes
1answer
2k views

Loki How to crack the password hash OSPF?

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF. Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I ...
2
votes
0answers
28 views

Multi Party Protocol - Proof with semi-honest adversaries

I have designed a protocol where one entity acts as a "client", sends information to one of many "server-parties". This second party sends some other information to another "server-party" and so on, ...
2
votes
0answers
215 views

How do adversary models and security types relate [closed]

Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement for ciphers. It got me thinking about this paper I recently read, where a formal model of the Honest-...
2
votes
0answers
99 views

Why don't cell towers authenticate with cell phones? [duplicate]

Stingrays exploit a significant security vulnerability of cell phones: phones attempt to identify themselves to, and even worse, continue to use fake towers. Why not have towers authenticate ...
2
votes
0answers
187 views

Implementation of existing smart lock methods

Smart lock? Apple, Android, Google, and now Microsoft have a feature called "auto|smart|dynamic|proximity lock" which enables to unlock your computer by simply carrying a (Bluetooth) support device ...
2
votes
0answers
85 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
2
votes
0answers
556 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 (...
2
votes
0answers
38 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
2
votes
0answers
133 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
4answers
702 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
1
vote
2answers
146 views

Is there any way to protect a client-side game from a hacked client?

Here's a toy example of a game: the player is presented with N slot machines. They can click on each slot machine once, and when they do so, the slot machine rolls a random outcome (based on a ...
1
vote
3answers
896 views

Which protocol should I use for secure message transfers between two servers?

There are two servers. I am going to transfer very secret messages from the first one to the second. The second server (the one that receives data) doesn't have access to any other resources except ...
1
vote
1answer
508 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
4answers
1k views

SSL Protocol Support

If I connect to a server using a specific SSL protocol version, but no cipher-suites are offered under that protocol, would that protocol still be considered supported? For example, connecting to a ...
1
vote
2answers
6k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
1
vote
1answer
404 views

Does TLS 1.3 encrypt alert messages?

I'm working quite some time now with TLS 1.3 implementations (OpenSSL, WolfSSL), but I can't find anywhere in the TLS 1.3 drafts if alert messages should be encrypted or not. I personally thought only ...
1
vote
1answer
680 views

Is it safe to use flex and bison as a protocol parser?

I started writing a a simple protocol lexer and parser for STOMP using flex and bison. Does anyone know of any security issues that might result from this? Edit: Added code. %{ /* Tokenizer for the ...
1
vote
2answers
195 views

How to find whether a site uses SET

How could I know whether the eCommerce site I use uses SET (Secure Electronic Transaction). I know SET is a standard. But I see only an SSL connection
1
vote
3answers
1k views

Three Message Authentication Protocol

I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
1
vote
1answer
418 views

Which of the TLS ciphersuites are more faste and secure in Handshaking?

I know "SSL 3.0" and TLS 1.0 have weakness security, because using of "RC4" cipher. instead it, "TLS 1.2" have more security, now I want to use of a fast ciphersuite and a complicated handeshake ...
1
vote
2answers
111 views

Is it possible to implement a secure game without having a reliable arbiter?

N players are playing a perfect information game (the kind of game where everyone knows moves of everyone) by making moves by turn (P1, P2, ..., Pn, P1, ..., Pn, ... till the game will finish). Game ...
1
vote
1answer
4k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
1
vote
1answer
164 views

Challenge Response across several hops

This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption". I need to send a certificate from the mobile phone to the server. Regardless of all the ...
1
vote
1answer
287 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
1
vote
1answer
495 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
1
vote
1answer
276 views

Are T4 and/or T30 fax protocols secure/encrypted?

I am trying to determine if the documents I send from my office fax machine are encrypted/secure or not. I found this article which kind of explains the current state of fax security: According to ...
1
vote
1answer
7k views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
1
vote
2answers
155 views

What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

This is a very newbie IT security question... I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need ...
1
vote
1answer
162 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
1
vote
1answer
248 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
1
vote
1answer
233 views

Is there a known vetted alternative to this key-exchange protocol?

I have three participants: A client A in possession of the public key Kpub A login server S in possession of the private key Kpriv Game servers B (B1, B2 etc) S and all B may share a finite number of ...
1
vote
1answer
49 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?