Tag Info

Hot answers tagged

7

Let's clear some bullshit first: Now as the NSA GCHQ et al know very well the more efficient you make the implementaiton of crypto code the more side channels it has unless extream caution is observed. One thing we do know is that optomised for speed and minimized number of gates is an almost certain guarentee of side channels no matter how clever you ...


5

I don't think NSA can break the underlying encryption primitives. What they may do is record the whole SSL traffic and decrypt the whole traffic using server private key. So you can use introduce perfect forward security as the blog article “SSL/TLS & Perfect Forward Secrecy” suggests. In addition man in the middle can be performed with fake ...


4

The equation $t'=t+n\cdot t_c$ is an estimation to put an upper limit on $t'$. It might be possible that an attacker $A'$ can use a different, more efficient algorithm. But since the attack will work with using $A$, there exists an attacker $A'$ with at most $t'$. This means it's actually not an equation, but an inequality $t' \leq t + n \cdot t_c$. And then ...


3

The scheme itself seems pretty standard, so it should be secure, if defined and implemented correctly. A simple textual descripion as you have provided here is not enough to prove your protocol secure. The authentication part only describes the RSA algorithm and key size - it does not specify how trust is established, nor does it define how the session keys ...


3

Good brief topic on security of this protocol for each version can surprisingly easy be found in Wikipedia. Also, please take a look on blog posts about SSL-stripping attack, also BEAST and SSL Recognition Attacks.


2

The resume of that other answer could be: When you have a password hashed, it's hard (very hard) to find out what was the original password: you have to try all combinations, until you find the hash. That's brute-force. Someone can speed up a bit this process, by pre-computing many passwords: he'll store all those passwords / hashes, and will try to find ...


1

Not necessarily. For example, if there is a public-coin collision-resistant hash family then there is a (statistical) zero-knowledge argument system (with negligible soundness error) for NP that uses a constant number of rounds and has a public-coin verifier. However, in the random oracle model, constant-round public-coin computational zero-knowledge ...


1

As correctly pointed out by Ricky Demer it is not necessarily true. However, this implication does not hold for very specific cases. In the case of random oracle gates the existence of the RO changes the functionality of the "scheme", since with RO there are RO-Gates and without there aren't. In most cases the existence of the RO does not affect the ...


1

You always need to have in mind that $A$ is a hypothetical algorithm, since our goal in the reduction is to contradict the existence of such an efficient $A$. Now to your concrete security framework: Here, you are not satisfied by the fact that a hypothetical poly-time $A$ implies a poly-time reduction $A'$, but your aim is that the reduction does not take ...


1

Security properties of hash functions are generally concerned with collision resistance, but preimage resistance is also important. For most common hash functions with an $n$-bit digest size, a successful preimage attack has generic $2^n$ maximum complexity, and a successful collision attack has generic $2^{n/2}$ maximum complexity. Most common hash ...


1

If the salt value is not secret and may be generated at random and stored with the password hash, a large salt value prevents precomputation attacks, including rainbow tables, by ensuring that each user's password is hashed uniquely. This means that two users with the same password will have different password hashes (assuming different salts are used). In ...


1

According to some sources, NSA is actually able to perform man-in-the-middle attacks using fake certificates to impersonate websites. Some people said that they somehow managed to hack a CA and stole compromised certificates. Since SSL/TLS relies mainly on certificates for authentication. With a valid "spoofed" certificate, users are easily tricked into ...


1

Digital signatures provide authentication, data integrity and non-repudiation. Thus, you are right to say that the authentication check is also basically an integrity check. If it didn't have an integrity check (i.e. no digital signatures) then you cannot be sure that the message you received is the original and unmodified version sent by the claimed sender. ...


1

The scheme as you describe it in itself may be secure in some (especially) theoretical environment. However, I don't suggest to use it, because any attempt to use of values passed between the peers can possibly undermine the security of the scheme as can e.g. insecure RNGs. I have expressed a few concerns below. I'm bit concerned about calling the scheme ...


1

I found this information which may be useful for you: Is encrypting twice good or bad? Does encrypting twice using the same block cipher produce a security weakness? Is there any benefit to encrypting twice with pgp? The general rule as far as I know, is that encrypting twice (regardless if its using the same cipher or not) is rarely ever going to ...


1

The "tricks" are Build "arbitrary-size FPE with associated data" by using S2V$\:\:$($\:\:$master_key$\:\:$,$\:\:$associated_data || plaintext_length$\:\:$) as the key for format-preserving encryptions with a disjoint domain for each possible $\:$ plaintext_length . and Map pairs $\:\langle$nonce,plaintext$\rangle\:$ into the domain determined by the ...



Only top voted, non community-wiki answers of a minimum length are eligible