joeuser3932

5 ms·

1.
by joeuser3932 11y ago
The momentary exposure in memory was the downfall of Lavabit. It is actually trivial to capture passwords submitted to servers during the momentary exposure. For example, when you login to a Drupal or Wordpress site over HTTPS, the POST get
2.
by joeuser3932 11y ago
PAKE only authenticates the password and generates a random session key. It doesn't enable the user to encrypt their data for a later session. If you don't know what the PRNG is for, perhaps a cursory 30 second lookover and then c
3.
by joeuser3932 11y ago
See the Tech Video. Defense against rainbow tables is periodic salt changing, to put a limited time scope on brute force calculation time.
4.
by joeuser3932 11y ago
Password on an x509 cert requires the x509 cert to be stored or made available to the client somehow. The whole point of CBCrypt is to allow password authentication and encryption without the user needing to change any behavior or learn any
5.
by joeuser3932 11y ago
Kerberos sends the password to the server. https://en.wikipedia.org/wiki/Kerberos_(protocol)
6.
by joeuser3932 11y ago
Take a closer look. The server has a copy of the client's public key on record before the authentication session begins. The server needs to authenticate the client. The server generates an ephemeral ECDH keypair. Now if an attacker ma
7.
by joeuser3932 11y ago
If you don't know what the PRNG (DRBG more appropriately) is for, you didn't watch the tech video. An asymmetric key generation algorithm can't work from a fixed length seed. You need to stretch the seed to an arbitrary lengt
8.
by joeuser3932 11y ago
Interesting. See also "Another huge security problem" posted a few minutes ago here. Maybe CBCrypt can use MAKWA.