Collaborate Disseminate
The FIPS 140-3 10.2.A Pre-operational Integrity Technique Self-test introduces new requirement. Prior to that, in FIPS 140-2, a Power On Self Test was done in order to be able to use a given part of a cryptographic module (e.g. RSA). With … Continue reading rationale for the FIPS 140-3 Pre-operational Integrity Technique Self-test
I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don’t want them to be able to access my wallets data in any way even if they have … Continue reading Isolating encrypted and unecnrypted Windows installations and protecting the boot loader
My Dev team creates high-load applications and wants to use Keycloak with OpenID authz. But they are complaining about delays for retrieving permissions from Authz server (Keycloak). So, they decided to define all permissions for each grou… Continue reading Authorization and permissions in backend
As you know Multi party computation (MPC) allows creating signature using private key shards and these key shards do not leave devices where they are stored.
Imagine that currently some HSM device stores private key and signs some data.
Wi… Continue reading Effect of increasing number of HSM devices used for MPC signing
I’m currently trying to use it for my thesis though quite unsure on what behavior should I expect from it.
Suppose this network scheme:
If there were a worm attack that spreads throughout the entire unsecured router network (which has 192… Continue reading Can Worm Infect Devices with Different IP Address?
I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf
But I can’t find any info about storing customers’ billing add… Continue reading Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)
I got a laptop from university and my account is on their corporate domain, so I log in with my university credentials. The anti-virus is Sophos Endpoint Security and Control and was installed by the IT department. I recently… Continue reading Can IT spy on you through anti-virus when using VPN?
It won’t be easy) As you know there are new PCI DSS requirements after 30 June which say we shouldn’t use “SSL/early TLS”.
But also there is the comments that merchants could save TLS 1.0 but with compensating controls:
… Continue reading TLS1.0 deprecation and PCI DSS requirements
Can someone explain me how one CA can fulfill normative request:
ETSI EN 319 411-2 or ETSI TS 101 456
“7.2.2 Certification authority key storage, backup and recovery … c)
the CA private signing key shall be backed up, stored and r… Continue reading fulfillment of : ETSI EN 319 411-2 or ETSI TS 101 456 – "7.2.2 Certification authority key backup using secure world daily backup on tape