Collaborate Disseminate
I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. Client side is iOS/Android App. I want to add a layer of safeguard on critical API by using client nonce to prevent (m… Continue reading Preventing resubmission and replay attack using client nonce in REST API
I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. The client side is iOS/Android app. I want to add a layer of safeguard on critical API by using client nonce to prevent (mostly) res… Continue reading Preventing resubmission and replay attack using client nonce in REST API
When you look at Amazons RESTAuthentication you can see that it doesn’t use a nonce:
Authorization = “AWS” + ” ” + AWSAccessKeyId + “:” + Signature;
Signature = Base64( HMAC-SHA1( YourSecretAccessKeyID, UTF-8-Encoding-Of( S… Continue reading Why isn’t Amazon using a NONCE for REST Authentication?
The OpenID Connect specification requires implicit flow clients to generate and validate a nonce:
String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
What replay attacks are those?
Put… Continue reading Purpose of nonce validation in OpenID Connect implicit flow
In the SSL handshake both the client and server generate their respective random numbers. The client then generates a pre master secret and encrypts it with the server’s public key. However, why can’t the client just generate the pre maste… Continue reading Why does the SSL/TLS handshake have a client and server random?
I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I could do this with Kerberos, … Continue reading 3rd Party Authentication protocol
I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I could do this with Kerberos, … Continue reading 3rd Party Authentication protocol
I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I could do this with Kerberos, … Continue reading 3rd Party Authentication protocol
I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to validate a form upon submission and avoid re… Continue reading when to use nonce?
If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key?
Simplified table structure:
Encrypte… Continue reading When using AES and CBC, is it necessary to keep the IV secret?