# Tag Info

3

This is vulnerable to a length extension attack. Given a valid nonce/MAC, the nonce can be extended to forge a new valid nonce/MAC value. This is because $m_4$ is appended to the end inside the outer hash. How this affects you will depend on how you validate your nonce. But in general, this is not a secure construction. There's probably more things wrong ...

3

The motivation, to me, is that in reality you can consider any router on the internet to be successfully executing an "intruder-in-the-middle" attack just by forwarding messages unchanged. After a successful execution of the identification scheme, Bob knows that someone on the channel is Alice, which is all the protocol was hoping to achieve. It was ...

2

The algorithm produces a password based on the value of the time that is input as an argument. That value does not have to be the current time. For the purposes for which TOTPs are generally used, there is no value in producing the password for a time other than the current time step - it won't be recognized by the validator.

1

It may be that that's due to lack of secure DNS (confirmation anyone?) So it turned out to likely be a warning about lack of DNS security. I also noticed that the signing algorithm is shown as a=rsa-sha1, and with the move to “Deprecate SHA-1” in other contexts, I'm wondering: how urgent this is for DKIM? Not very urgent. Current attacks only put ...

Only top voted, non community-wiki answers of a minimum length are eligible