Questions tagged [security]

Questions about matters of computer, software and communication security, that is how to protect systems against attacks.

Filter by
Sorted by
Tagged with
1
vote
1answer
24 views

When compiled into binary, what signifies the end of a string? How can this be differentiated from user input which compiles to the same binary?

Apologies for the strange title, this is one of those questions I can't find through a Google search just because I don't even know what I'm supposed to be searching for. As I understand it, programs ...
1
vote
0answers
15 views

Are Physical 2-Person Lock Systems Informed by The Byzantine Generals Problem

The Byzantine Generals Problem says a set of generals who are greater than 2/3rds loyal is required to guarantee that securely issuing an order is possible the loyal generals. Because of this, I am ...
3
votes
0answers
90 views

How does a vpn connection work?

I have been looking into vpn (virtual private network). And I wanted to know more about the theory, how does it work really: what does it do with the packages? why is it secure? (or why can it be ...
2
votes
2answers
49 views

Why don't most websites I visit seem to use TLS with Ephemeral Diffie-Hellman?

When I click "view certificate," under Public Key Algorithm it usually says "RSA Encryption" or "Elliptic Curve Public Key." I assume this is the algorithm used to agree on a premaster secret (...
9
votes
1answer
3k views

What is oblivious RAM and how does it work?

Could anybody explain me what exactly oblivious RAM is? I found the following explanation which makes it kind of clear to me, but I would like to get a sense of the technical aspects: Encryption ...
0
votes
1answer
49 views

Matrix to Multi-level security

How to convert access control matrix to Bell-LaPadula. Can teach me step by step What best way to control converting Bell-LaPadula Model lattice using Access Control Matrix Matrix GIVEN $\quad\quad\...
10
votes
2answers
791 views

Can you prevent a man in the middle from reading the message?

I have heard about all these Man-In-The-Middle Attack preventions and I am wondering, how this can possibly work if the man in the middle only listens to your stream and does not want to change the ...
0
votes
3answers
70 views

How long does it take to crack a password by brute force

My computer teacher says that hackers can know any password by simply writing a permutation combination program and it will take around 21 days. Is this true?
5
votes
2answers
413 views

What is the complete version of the paper: “How to Generate and Exchange Secrets (extended abstract)” by Andrew Yao?

I've found numerous places that claim that the paper "How to Generate and Exchange Secrets" by Andrew Yao introduces garbled circuits as a solution to the secure multiparty computation problem. ...
1
vote
1answer
342 views

How pictures and videos are usually loaded in Memory? [closed]

Lets assume I'm talking about Jpeg and Mp4 and a general video player(not sure if different ones load it differently, if they do please tell) So do video players (process) usually load the entire ...
0
votes
1answer
126 views

NX Bit in x86 vs x86_64

I've been reading about how the kernel manages memory in x86 from this popular blog post(https://manybutfinite.com/post/how-the-kernel-manages-your-memory/) and had a few questions. There is a part ...
2
votes
2answers
62 views

Password authentication over an insecure connection

I was thinking a way to send password to server secure way without using secure connection,I found one solution.I want to find flaw in this.(Note: I am begginer,dont judge me, I know little about ...
2
votes
0answers
44 views

Agreeing on a Time in a Trustless Network

Imagine a chord-like network $N$. each machine $m \in N$ is directly connected to $N_m \subset N$. Without relying on official timeservers, I want all machines to synchronize to some time with ...
0
votes
1answer
25 views

how to defend against DOS caused by SYN cookies? [closed]

i have read about SYN cookies and i understood that they help to avoid DOS .. BUt my prof wants an answer as how SYN cookies can be used to cause DOS and how can it be avoided ? any help woul dbe ...
0
votes
1answer
76 views

How does a buffer overrun corrupt the return address?

I got stuck on the following note while reading a paper about computer security: The stack mixes program data and control data – by overrunning buffers on the stack we can corrupt the return ...
0
votes
1answer
34 views

Can SSL be hacked if we know some of plain data?

As I know, SSL/HTTPS is two stage, first stage is public key encryption/decryption which transfers key of the second stage which is symmetric. It is true we don't have key, but we can have some of ...
2
votes
1answer
24 views

Formally modelling and describing access rights

Is there a formal theory or framework described in text books that models access rights in a mathematical way. I would expect things similar to the following: We have data (objects). We have ...
49
votes
6answers
10k views

Keeping a String Secret in (Open) Source Code

I have finished developing an app for Android and intend to publish it with GPL -- I want it to be open source. However, the nature of the application (a game) is that it asks riddles and has the ...
0
votes
0answers
24 views

Secrecy rate of eavesdropper channel?

I want to find secrecy rate of a main channel in case of Gaussian broadcast channel. e.g. I have a single transmitter and a receiver where eavesdropper wants to eavesdrop the communication over ...
1
vote
2answers
39 views

Would limiting the number of operations in a transaction prevent SQL injection?

In my understanding all SQL injections need to add another operation to the one intended by the programmer. For example, a badly written query: ...
8
votes
5answers
2k views

Would it ever be possible for computer viruses to evolve new “genes” to allow them to perform their job?

As an A-level Biology student, I have thought a lot about the links with Biology and Computer Science, and something that often comes to mind are the links between Immunology and Computer Security/...
2
votes
1answer
50 views

How is tamper-proofing of software evaluated for effectiveness?

How is tamper-proofing of software evaluated for effectiveness? I've been implementing a few algorithms listed within Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for ...
1
vote
0answers
75 views

Importance of Needham–Schroeder Protocol

I'm working on a paper about model checking on cryptographic protocols and many of the papers I have read, base their approaches in the Needham-Schroeder protocol. I undestand this was one of the ...
2
votes
3answers
232 views

Can software itself be encrypted?

Imagine that I need to install my server in a remote location, so my algorithm can do something fancy (collocation of server at a financial exchange is how I thought of this question, but it applies ...
2
votes
4answers
168 views

Using two hash functions for increased password security?

Forgive me for my brief knowledge on hash functions as I am not from a computer science background, however I am researching password security for my thesis and have been looking into hashing ...
3
votes
1answer
373 views

Computer Security versions of the Halting Problem

I'm plenty familiar with the Halting Problem for Turing Machines. It occurred to me after reading several posts on this site that it would be interesting, educational and useful to start a list of ...
1
vote
1answer
55 views

Are there any examples of programming synthesis in vulnerability research?

Program Synthesis To borrow from Microsoft: Program synthesis is the task of automatically discovering an executable piece of code given user intent expressed using various forms of constraints ...
2
votes
0answers
66 views

Could an OS relinquish control back to the bootloader?

I'm wondering if it is feasible for an OS to return control back to the bootloader, and boot a second OS after itself. Reason being -- I've been musing on bootkits, and wondering if it would be ...
1
vote
0answers
99 views

What is an access control graph?

A question I came across describes a scenario of an information system in a clerical office and states- "Identify the sets of S={subjects}, O={objects} and P={privileges} for the above systems of the ...
7
votes
2answers
148 views

Zero-knowledge proof: Abstract example

So I was reading about ZKP on wikipedia, the abstract example in summary goes like this: Peggy wants to prove to Victor that she knows the secret to a door inside a cave that connect A and B ...
1
vote
0answers
326 views

How Can a Network Server Identify a Specific Computer, Is There a Computer Fingerprint?

Most of websites put some restrictions on how to use their services; the following paragraphs are taken from “Terms of Service” of such website: Only one account per computer is allowed to view ads. ...
2
votes
1answer
75 views

User recognition through keystroke pattern

Hello thank you for taking time looking at this question. Is it possible to determine the keystroke patterns for a certain user? My idea is that, when the user enters their username & password it ...
3
votes
1answer
311 views

Why do ACLs (access control lists) have better persistence than capabilities?

Although I understand the principles on which both ACLs and Capabilities operate, I do not see why on system restart it would be favourable to store privileges by using ACLs, instead of capabilities ...
2
votes
1answer
45 views

What exactly would stop me from registering a domain from my own nameserver? [closed]

Can I just make a nameserver and claim away? Are there implemented measures to stop this from happening?
-1
votes
1answer
40 views

will breaking not used anymore RSA codes in the future affect privacy?

just read and watch some stuff on how RSA works. main idea seems to be if someone steals your communication he cannot decode it anyway. but let's say someone steals it and keeps it along with current ...
2
votes
1answer
45 views

Oblivious RAM write protection

I'm trying to understand how oblivious RAM works, specifically path oblivious RAM. While I understand how this technique offers protection when reading data - multiple randomly distributed reads ...
-1
votes
1answer
35 views

Which “ID” extraction is correct?

This question related to attack on the LMAP++ the result of extracting ID from the messages. In Passive Attack on RFID LMAP++ Authentication Protocolm, page 188 ...
8
votes
2answers
87 views

Running an algorithm on data remotely and ensuring answer has not been tampered with

I´ve been thinking about this particular computing/crypto/database problem for years and I just want to know if there are already solutions to it. To be honest I don´t even know what field this ...
2
votes
1answer
209 views

Can Eve impersonate Alice or Bob by using a replay attack?

For my computer science study, I have to design a replay attack (if possible) for the following authentication protocols. I use the standard security protocol notation. In these protocols, $A$ is ...
1
vote
2answers
70 views

Why is the star property important

According to the Bell-Lapadula model, write access is only to Subject $S$ on object $O$ provided if: $L(S) \leq L(O)$ where $L$ is the clearance level for $S$ and classification for $O$. This seams ...
0
votes
1answer
43 views

Validating authenticity of a file

Suppose there's an entity which produces files. User A has one of those files and decides to send it to user B. How can user B validate the authenticity of the file without communicating with the ...
3
votes
0answers
246 views

How is Chinese Remainder Theorem used in the proof of correctness for RSA

Question At the very end of (most) proofs of RSA's correctness we have something like $$m^{ed}\equiv m\pmod p$$ $$m^{ed}\equiv m\pmod q$$ Therefore by the Chinese Remainder Theorem (CRT) $$m^{ed}\...
3
votes
2answers
2k views

Can the Bell-LaPadula model emulate the Chinese Wall model?

I have been reading on security policies and the question wether Bell-LaPadula can be used to implement Chinese Wall. Does anyone know more about it?
2
votes
1answer
54 views

How to make a “Secure by Design” client-server communication?

Is there a way to have a secure by design client-server communication in a sense that the server can check if the client is not a modified version? What I'd like to do is give the user access to both ...
2
votes
3answers
43 views

Existence of functions that only tests memberships without revealing any information about the members

Given a set of strings $\{s_1, s_2, \cdots, s_n\}$, is there a way to encode them to a program $P$, such that given some string,$s$, the program can test the membership efficiently (deterministically ...
2
votes
1answer
134 views

Is a very long plain text password harder to crack than a short complicated password? [closed]

Is it true that a password consisting of the alphabet, even of common known names is much harder to find for a computer program than a short password, even though it uses numbers and other characters?
0
votes
1answer
33 views

Can file snapshots aid in detecting malware?

I noticed certain programs have a feature that can have a 'snapshot' of a file from a certaim time and compare it to a more recent snapshot of the file. If one's system has a snapshot of a program ...
0
votes
1answer
685 views

Two Step Verification. 4 digits vs 6 digits

From a security level standpoint (such as Server, DataBase, Token Code, Authorization, Authentication, etc.) in regarding the Two Step Verification, usually Apple send a total of 4 digits security ...
1
vote
2answers
78 views

Handling TOCTTOU with system calls

What are some of the best practices when implementing system call functionality for handling/avoiding "Time of check to time of use" (TOCTTOU) security issues?
18
votes
2answers
5k views

How does an operating system create entropy for random seeds?

On Linux, the files /dev/random and /dev/urandom files are the blocking and non-blocking (respectively) sources of pseudo-random ...