7 votes

Zero-knowledge proof: Abstract example

I believe this is done to illustrate two things. (i) The small probability, that $P$eggy ($P$rover) might be lying. If she really does not know the magic word and $V$ictor ($V$erifier) sees her ...
user avatar
  • 138
3 votes

Can Eve impersonate Alice or Bob by using a replay attack?

well, you don't really explain what happens in each step, and how the authentication procedure works, but your first suggestion is at the right direction. However, the impersonator wishes to ...
user avatar
  • 20.4k
3 votes

Zero-knowledge proof: Abstract example

The article tries to illustrate the property that a zero knowledge proof is only convincing to the observer. In other words, the observer would not be able to convince someone else later. It does so ...
user avatar
  • 113
2 votes
Accepted

User recognition through keystroke pattern

Keystroke dynamics is indeed a form of biometric recognition that has been studied for a long time. It was already known in the telegraph era: skilled operators could recognize each other's “fist”, ...
user avatar
1 vote

Do ‘unspoofable’ email protocols exist?

There are several protocols actually: SPF Sender Policy Framework is used to verify that the e-mail address used to send the message is valid e.g. if the sender had rights to use the given domain. ...
user avatar
1 vote

How does storing encrypted password provide secure authentication?

Actually, storing an unencrypted password can be OK in certain circumstances, depending on what the password is used for and the threat model you are trying to defend against. In any case, if you are ...
user avatar
  • 143k
1 vote
Accepted

Password authentication over an insecure connection

First, note that a way to perform password authentication, or any kind of user authentication, over a connection is only useful if you assume that the attacker can see the data exchanged over the ...
user avatar
1 vote

Password authentication over an insecure connection

If you don't use a secure connection, it is vulnerable to man-in-the-middle attacks, so not secure. If you do use a secure connection, then it is no better than sending the password directly.
user avatar
  • 143k
1 vote

Two Step Verification. 4 digits vs 6 digits

The number of digits in such a one-time password is determined by the acceptable risk that an attacker who doesn't receive the verification code will be able to guess it (lucky guess). This risk takes ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible