Category Archives: session management

How can I use PBKDF2 to derive an encryption key from a password and then access that key later without the password (i.e. with a cookie)?

Posted on by

I’m developing a notetaking app that will store users’ note and file data encrypted in a db and on backblaze (respectively). The app will not be end-to-end encrypted but data will be encrypted in transit (with TLS) and at rest (AES256, for… Continue reading How can I use PBKDF2 to derive an encryption key from a password and then access that key later without the password (i.e. with a cookie)?→

Do browsers like FireFox, Chrome, Opera, and Tor store TLS 1.3 session tickets on the disk?

Posted on by

Do browsers save TLS 1.3 session tickets on the disk to resume a TLS session after the browser process has been killed and restarted?
Are there any glaring security risks of caching TLS 1.3 session tickets on the client side? I believe th… Continue reading Do browsers like FireFox, Chrome, Opera, and Tor store TLS 1.3 session tickets on the disk?→

Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage? [duplicate]

Posted on by

If the SessionID is leaked/hacked by someone else and they use that SessionID to get access to the account, can we double-check whether the SessionID is used on the right device? I’m thinking of checking the device fingerprint and whether … Continue reading Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage? [duplicate]→

NTRU – How is the master key and session key generated?

Posted on by

I am learning the PKC topics and would like to understand about the master and session key generation process regarding NTRU.
Let’s make it a scenario, if a user wants to register during the registration process, the information obtained f… Continue reading NTRU – How is the master key and session key generated?→