Collaborate Disseminate
I’m new in web pentesting and I have read a lot of books.
But I think I should read some RFC to have a better knowledge about web applications.
There is a lot of RFC and I’m a bit lost on which one should I read…
i’m st… Continue reading Which RFCs should I read for web pentesting? [on hold]
How RFC 5755 is compared to RFC 3281 for attribute certificates?
RFC 8032 provides ed25519, ed25519ph and ed25519ctx. ed25519 is Bernstein’s signing using curve25519. ed25519ph and ed25519ctx are IETF additions. I have a working ed25519.
I’m trying to extend things to ed25519ph, which sho… Continue reading What is the message to be prehashed for ed25519ph example from RFC 8032?
from A Detailed Look at RFC 8446 (a.k.a. TLS 1.3)
RSA encryption was removed from TLS 1.3, leaving ephemeral Diffie-Hellman as the only key exchange mechanism.
Which sentence in RFC8446 does say this ?
TLS support… Continue reading RFC 8446 – RSA Key Exchange removed
I’m wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend server (confidential client) that does. … Continue reading OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
A qualified trust service provider under eIDAS uses ESSCertIDv2 for their time stamp tokens, but ESSCertIDv2 was not present in the RFC 3161 specification, it was added later in RFC 5816.
RFC 3161 in 2.4.2 requires ESSCertID:
The certific… Continue reading Use of ESSCertIDv2 in a RFC 3161 Timestamp
Problem
curl rejects the CA certificate below with 60) Certificate type not approved for application for SEC_ERROR_INADEQUATE_CERT_TYPE. I would like to understand the reason.
SEC_ERROR_INADEQUATE_CERT_TYPE
Problem
curl rejects the CA certificate below with 60) Certificate type not approved for application for SEC_ERROR_INADEQUATE_CERT_TYPE. I would like to understand the reason.
SEC_ERROR_INADEQUATE_CERT_TYPE
In RFC6960 (https://tools.ietf.org/html/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided.
But when I had a look on OCSP’s ASN.1 specifica… Continue reading RFC6960 requested ocsp service definition
In RFC6960 (https://tools.ietf.org/html/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided.
But when I had a look on OCSP’s ASN.1 specifica… Continue reading RFC6960 requested ocsp service definition