New answers tagged ssl
4
CRAM-MD5 is a protocol to demonstrate knowledge of a password. In the context of email, it is sometime used by an email client to authenticate to a POP, IMAP, or/and SMTP server. Basically, the password is used as the key of HMAC-MD5 in a challenge-response protocol.
Among positive things there are to say about CRAM-MD5:
The password is not exchanged in ...
-1
Cryptography aside, your server provider is incompetent and you should switch immediately. There is absolutely no reason why anybody should be storing passwords in plain text in 2013.
1
Have you considered generating the IV in a cryptographically pseudorandom way? This approach makes it easiest to be sure that you're not introducing some subtle weakness in your IV selection.
I would start by benchmarking how fast it is to use RandomNumberGenerator. If that's fast enough, job done. I would not give up on that idea until you know that it ...
2
To answer your specific questions:
From reading around I understand that ... encrypting a counter and use that as the IV is OK,
is that true?
For CBC mode, that is absolutely true, as long as the key that you use to encrypt the counter is secret (that is, not known to any possible adversary).
Should I start in random number?
Actually, that's ...
Top 50 recent answers are included
