Tagged Questions
4
votes
2answers
743 views
Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?
I need a method to authenticate a process with another in order to establish interprocess communication between them, to prevent malicious processes from trying to hook onto the system. Currently I ...
5
votes
1answer
215 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
4
votes
4answers
489 views
How can I validate a hashed password if all I have is another hash?
The Scenario
I have a client-side web application that bounces requests against a server-side API. For the sake of simplicity, every request must pass a username and password. This is similar to ...
1
vote
1answer
117 views
How is the password sent across for verification?
I am familiar with Challenge-Response Authentication scheme.
However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.
...
5
votes
3answers
1k views
SHA1 usage for passwords, alternatives and advantages?
My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to ...
1
vote
3answers
348 views
Is public-key cryptography the only option in this scenario?
Two parties: a client and a server are to a agree on a symmetric key. Both the client and the server are aware of a master password. The way this is currently done ...
7
votes
2answers
547 views
How should I store passwords that need to be available in plain text?
Suppose I need to store login information for a third-party website for a few users, how would I go about doing it?
Since I am logging into a third party website, I need the password in plain-text, ...
