Questions tagged [rfc]

How to interpret security aspects of RFC (Request For Comments) documents.

Filter by
Sorted by
Tagged with
2 votes
1 answer
170 views

Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. ...
user avatar
0 votes
2 answers
159 views

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization ...
user avatar
  • 121
1 vote
1 answer
448 views

How to convert 64byte openssh-key-v1 to the resulting 32byte ed25519 private key

I wrote an openssh-key-v1 Protocol reader and extracted all fields according to the format definition: "openssh-key-v1"0x00 # NULL-terminated "Auth Magic" string 32-bit length,...
user avatar
0 votes
0 answers
63 views

Why does RFC5816 not change the version number defined in RFC3161

So, RFC5816 https://www.ietf.org/rfc/rfc5816.txt changes the specification of RFC3161 https://www.ietf.org/rfc/rfc3161.txt RFC3161 specifies the 'version' field in TSTInfo to be set to 1 Why does ...
user avatar
0 votes
1 answer
90 views

What header & footer to use when storing RFC3161 token in PEM format

The RFC3161 (https://www.ietf.org/rfc/rfc3161.txt) specification states 3. Transports There is no mandatory transport mechanism for TSA messages in this document. The mechanisms described ...
user avatar
0 votes
1 answer
94 views

Benefits of Token Exchange protocol

Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
user avatar
  • 101
-3 votes
1 answer
141 views

Can TLS create PKI for you? [closed]

Suppose A and B want to create TLS secure channel. But they do not have pre-shared secret, or mutually trust Certificate, How do they do?
user avatar
4 votes
1 answer
302 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
user avatar
0 votes
1 answer
266 views

Which RFCs should I read for web pentesting? [closed]

I'm new in web pentesting and I have read a lot of books. But I think I should read some RFC to have a better knowledge about web applications. There is a lot of RFC and I'm a bit lost on which one ...
user avatar
  • 374
2 votes
0 answers
360 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
user avatar
2 votes
2 answers
2k views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
user avatar
  • 694
1 vote
1 answer
147 views

Use of ESSCertIDv2 in a RFC 3161 Timestamp

A qualified trust service provider under eIDAS uses ESSCertIDv2 for their time stamp tokens, but ESSCertIDv2 was not present in the RFC 3161 specification, it was added later in RFC 5816. RFC 3161 in ...
user avatar
  • 373
3 votes
1 answer
2k views

Why does curl/NSS encryption library not allow a CA with the extended key usage by SEC_ERROR_INADEQUATE_CERT_TYPE?

Problem curl rejects the CA certificate below with 60) Certificate type not approved for application for SEC_ERROR_INADEQUATE_CERT_TYPE. I would like to understand the reason. ...
user avatar
  • 265
1 vote
0 answers
85 views

RFC6960 requested ocsp service definition

In RFC6960 (https://www.rfc-editor.org/rfc/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided. But when I had a ...
user avatar
  • 11
2 votes
2 answers
226 views

TLS Extentions: Omitting TLS Handshake Messages

I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS ...
user avatar
2 votes
1 answer
713 views

Designing CP and CPS for multiple hierarchical CAs

I am thinking about how to design and structure CP and CPS for multiple CAs build in a hierarchical manner and compliant to RFC 3647. The structure of CAs in build from one Root CA to multiple ...
user avatar
  • 1,079
7 votes
2 answers
438 views

Why did RFC 4158 (Path Building) restrict Trust Anchors to self-signed certificates?

I'm having trouble using Wget to download a file over HTTPS from ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-...
user avatar