3
When you are using private/public key authentication and agent forwarding, a full ssh mitm attack is still possible. Agent forwarding is a security issue and should not be used.
In cases, when agent forwarding is not used, a full ssh mitm attack is not possible, but an attacker can redirect the traffic to another server and log your input. When you are using ...
3
AES as it stands a block cipher with 16-byte block size and 16, 24, and 32-byte key sizes.
To encrypt even one bit, you need additional data. On the simple thaught, one can consider filling the rest with 0, then during decryption, there will be ambiguity. That is after the decryption, that data is 1 or 10 or 100 ... if the encrypted bit was 1 and similarly ...
2
This is simply a number pad implementation of the plain old original scytale. Using the number 5 key on the pad instead of a rod.
It's a basic substitution cipher.
Was the TV show the first to use the number pad in this way? I cannot answer that. I doubt it.
2
Let formalize the secret in the middle as;
signature = Hash( m[1..l/2] || secret || m[l/2+1..l] )
where l = len(m). This construction is not differ from the original H(k,m) since simply consider that k = m[1..l/2] || secret and then apply the length extension attack, success!
The attack append-only attack H(m,k) - linked by user49075 on the comments - ...
2
Key splitting (best case scenario)
The ideal cryptographic algorithm for this purpose is Shamir's Secret Sharing, as it provides Information theoretical security, meaning it's mathematically impossible to recover the actual key without having the k number of shares specified by the person splitting the key.
We don't know how many shares are needed, and/or if ...
1
While it is possible to gain an improvement in security by encrypting data with multiple algorithms in this way, it's generally not needed and not a good idea.
If you are using a secure 256-bit AEAD algorithm with a securely generated key and nonce (that is, using a KDF or both randomly generated on each use), such as AES-GCM or ChaCha20-Poly1305, you're ...
1
According to Raymond Chen at Microsoft, even version 4 GUIDs used in Windows since 2000 are not cryptographically secure. They use the basic random number generator, which can allow someone to predict past and future GUIDs if they know the state of the generator. Granted, this would only be relevant to a security-sensitive application. It's important to know ...
1
A keyless entry system means just that: it allows the entry into the vehicle (by unlocking the doors) without using a key, usually using some sort of radio fob. Many vehicles also pair this fob with an anti-theft (immobilizer) system and require the fob to start the car, but they need not be the same thing.
In systems with radio fobs, cryptography is ...
1
Conceptually, this is possible and secure.
Whether it's a valid program in particular depends deeply on the arcana of the atrocious OpenSSL API (for example, explicitly requesting the GCM tag is required when using GCM with OpenSSL, as it will cheerfully both encrypt and decrypt with no tag ever generated or input). I'm not going to say for sure that this ...
1
The general idea behind such proof is that A signs some message ("challenge") created by B with its private key - and that this signature can be checked.
B creates a random challenge which is then signed by A. It is important that this challenge is not predictable in order to avoid replay attacks. A then sends the signed challenge and the public ...
Only top voted, non community-wiki answers of a minimum length are eligible
