116 reputation
3
bio website codepark.blogspot.com
location
age
visits member for 2 years
seen Jul 10 '12 at 7:57

Jul
5
comment Poor man's SSL - is this method as safe as SSL/TLS?
@PaĆ­loEbermann: In my case dropping or replaying message is not a problem - I may treat it as noise (it's a live transmission of video and audio so I may accept such cases as long as I am able to send content as fast as possible). Thanks for your comments, you've been very helpful.
Jul
5
comment Poor man's SSL - is this method as safe as SSL/TLS?
@PaĆ­loEbermann: Do I need sequence number if I'm sending data over tcp? I was thinking that my frame would like this: [messsage length][encrypted content][hmac]. If anyone would be able to insert segments into the tcp stream then it would be seen as noise that could potentially break the transmission (I'm not sure how the tcp library handles such case) but I don't consider it to be a security problem. What is important is that I could verify the message and it is not possible for anyone unauthorized to read the content.
Jul
5
comment Poor man's SSL - is this method as safe as SSL/TLS?
If add HMAC (e.g. Encrypt then MAC as described here daemonology.net/blog/2009-06-24-encrypt-then-mac.html) it should be safe in your opinion, right? Of course HMAC will use different key that would also be exchanged using https.
Jul
4
comment Poor man's SSL - is this method as safe as SSL/TLS?
I'm experiencing this issue in SilverLight. SSL at socket level is available in third party libraries. Since SilverLight doesn't support NetworkStream abstraction using third party library basically requires rewriting transport layer in my application.