3
votes
Does any real world protocol makes use of the associated data in AEAD?
Yes, absolutely. TLS uses the additional data to authenticate the packet header (RFC 8446 § 5.2). TLS 1.2 included sequence number in the additional data computation because doing so prevents replay ...
- 6,695
3
votes
Steganographically hide encrypted packets for VPN, Tor, etc?
There are several standards used to mask traffic as another protocol, this will however not protect you against the observer recognizing that your mere connection with a certain remote host is a bad ...
- 101
2
votes
Accepted
Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?
I don't think it's useless. Think of pre-shared key as an extra layer of protection for the TLS channel, requiring that incoming connections are correctly HMAC signed by the PSK key.
This feature ...
- 1,892
1
vote
I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?
A correctly generated v4 UUID is always cryptographically random, that's in the spec. Verifying this, short of looking at the source code, is difficult. There are tests you can run (e.g. Burp Suite's &...
- 38.7k
1
vote
Accepted
Does any real world protocol makes use of the associated data in AEAD?
I've designed a system or two that used AEAD. I borrowed it as good practice from smarter crypto guys than me.
For instance, it's very useful to tie cipher text in a key:value datastore to it's key ...
- 871
Only top scored, non community-wiki answers of a minimum length are eligible