2022 Developer Survey is open! Take survey.
3 votes

Does any real world protocol makes use of the associated data in AEAD?

Yes, absolutely. TLS uses the additional data to authenticate the packet header (RFC 8446 § 5.2). TLS 1.2 included sequence number in the additional data computation because doing so prevents replay ...
user avatar
  • 6,695
3 votes

Steganographically hide encrypted packets for VPN, Tor, etc?

There are several standards used to mask traffic as another protocol, this will however not protect you against the observer recognizing that your mere connection with a certain remote host is a bad ...
user avatar
2 votes
Accepted

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

I don't think it's useless. Think of pre-shared key as an extra layer of protection for the TLS channel, requiring that incoming connections are correctly HMAC signed by the PSK key. This feature ...
user avatar
1 vote

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

A correctly generated v4 UUID is always cryptographically random, that's in the spec. Verifying this, short of looking at the source code, is difficult. There are tests you can run (e.g. Burp Suite's &...
user avatar
  • 38.7k
1 vote
Accepted

Does any real world protocol makes use of the associated data in AEAD?

I've designed a system or two that used AEAD. I borrowed it as good practice from smarter crypto guys than me. For instance, it's very useful to tie cipher text in a key:value datastore to it's key ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible