Tag Info

Hot answers tagged

3

rand() is bad because it's not a random function - not even a mediocre one. Every library, operating system, yahoo with a keyboard, can write his own rand and get away with it. The purpose of rand is to give output that looks random enough to be used in non-critical applications, usually with an LCG. Once in a blue moon you might come across some library ...


3

In the example you linked, the current time (specifically, a value representing the number of seconds elapsed since Jan 1, 1970 UTC) is used as the seed. If an attacker knows which year you generated your key, then that leaves only about 2^25 possible values for the seed --- and therefore only about 2^25 possible values for your key. At this point, he can ...


1

The attacker acts as a man-in-the-middle and can forward the clients nonce to the server and the servers nonce to the client. As a result both parties establish a connection with the attacker using the same nonces. Because of a weakness in the TLS protocol, the two connections can have the same key, and this key is known to the attacker. After resumption ...



Only top voted, non community-wiki answers of a minimum length are eligible