Collaborate Disseminate
What I understand from the stack question:
“What is the use of a client nonce?”, is that nonce cannot be trusted since the malicious attacker can act as the server himself and send the same nonce over and over. Making it pos… Continue reading HMAC: What is the use of a server nonce on top of using a client nonce?
I have a url with a $_GET parameter that allows deleting of a record in my database, eg. localhost/app/delete.php?id=4843.
The delete.php page only checks to see if the user is signed in and that they own the db record. Obvi… Continue reading When And How To Generate Nonce For URL
I am not cryptography expert so please forgive this basic question. I am trying to understand how the flow of the KRACK attack takes place in order to better understand why the encryption protocol itself can be cracked.
Lets… Continue reading Is this the correct flow of the KRACK attack?
I am not cryptography expert so please forgive this basic question. I am trying to understand how the flow of the KRACK attack takes place in order to better understand why the encryption protocol itself can be cracked.
Lets… Continue reading Is this the correct flow of the KRACK attack?
I learning about nonce and crypto nonce and i don’t understand the diffrance between cnonce and nonce.
and how it compare to salt and mac.
thanks.
Continue reading cnonce and nonce.what are the diffrance? [on hold]
I have used APIs that require a nonce for every request. If HTTPS requests are not replayable, seen here https://stackoverflow.com/a/2770133/2800469, what is the reason to require nonces for HTTPS APIs?
Is it just to ensure … Continue reading What is the use of nonces in HTTPS APIs
I am currently working with a symmetric algorithm which requires a nonce for encryption, and logically for decryption as well.
However, I am a bit confused about how I would go and synchronize the nonce on both clients.
Let… Continue reading How to synchronize a nonce between two participants?
I’m creating a SOAP server with WSSE. As the specification suggest (https://www.oasis-open.org/committees/download.php/13392/wss-v1.1-spec-pr-UsernameTokenProfile-01.htm), my client needs to pass a time aware token (nonce) wh… Continue reading Time aware token on WS security (WSSE)
The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent replay attacks and has some implementation… Continue reading Openid connect nonce replay attack
In a web-based auth system I do the following:
Client: Ask the server for a “nonce”.
Client: Generate a “cnonce”.
Client: hash(nonce + cnonce + password)
Client: Send cnonce and the hash from point 3 to the server.
Server:… Continue reading How to only send hashed passwords while not storing passwords in plaintext on the sever?