Tagged Questions
0
votes
0answers
23 views
How can I validate generated session keys in SRP-6a protocol
I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 ...
3
votes
3answers
150 views
Efficient Symmetric Mutual Entity Authentication Protocol
I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
1
vote
0answers
100 views
Computer appliance protocol
I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
5
votes
1answer
215 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
4
votes
3answers
355 views
Is this a secure implementation of password reset email?
I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are:
Expired
Tamper Resistant
Single Use
...
1
vote
0answers
92 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
3
votes
1answer
331 views
Efficient and stateless anti-forgery method
One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
1answer
445 views
RSA-based authentication and key-agreement protocol
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.
To that ...
4
votes
2answers
1k views
What advantage does facebook's new encrypted access_token have?
When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation.
...
1
vote
1answer
121 views
How to collect, process, and transmit data securely?
In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
