IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [nonce]

a random number that is only used once. It is generated at the beginning of a communication by one communication partner and has to be sent back by the other one in order to prevent replay attacks.

85 questions
3
votes
1 answer

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets doubled by effectively introducing a second round…
orlp
  • 391
  • 2
  • 15
3
votes
0 answers

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify App and am having problems to see how the…
Domi
  • 131
  • 1
3
votes
1 answer

Is it ok to append the nonce/iv to the ciphertext when using AES GCM?

I want to use AES GCM to encrypt data at rest. When retrieving the data, I want to make sure that the key is valid and the data has not been tempered with. Can I store the nonce/iv along with the ciphertext in the database?
machete
  • 247
  • 2
  • 4
2
votes
1 answer

Risk associate with nonce and hash found in url

I have came across a url with nonce and hash in placed which is an account activation link sent via email. The example is as…
Traveller
  • 103
  • 1
  • 2
  • 8
2
votes
3 answers

How to create a secure nonce for WSSE

I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important. I found very different implementations: *…
PiTheNumber
  • 5,394
  • 4
  • 19
  • 36
2
votes
1 answer

Is it necessary to encrypt nonce in cryptographic communication?

Server and client have a pre-shared key K. Assuming that that pre-shared key is safe, so nobody other than server/client can encrypt/decrypt. Client sends a nonce N to server, server then sends back message M in encrypted form AES_CBC_Encrypt(M+N,…
Krypton
  • 228
  • 1
  • 6
2
votes
2 answers

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique does the nonce need to be, or, for how long should the…
az_
  • 165
  • 2
  • 6
2
votes
1 answer

IKEv2: Why is it important "that each side sign the other side's nonce"

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that each side sign the other side’s nonce" Can anyone…
sege
  • 23
  • 4
2
votes
1 answer

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a different server. While some calls are simply…
NullHypothesis
  • 191
  • 1
  • 4
2
votes
1 answer

Nonce construction for CTR mode (Mcrypt)

Edit: I'll put up this more clearly. By the most simplest form, I'm asking that if I AES encrypt in CTR more with Mcrypt (using PHP), can I create the "IV" by just simply reading 16 bytes from /dev/urandom? Does that do the job properly? I read the…
timoh
  • 499
  • 2
  • 9
2
votes
1 answer

Is it insecure to ask for the current nonce from server?

I'm developing an embedded application that delivers information through HTTP to my web server. These deliveries are secured by a hash H(secret : data : nonce) where the secret is shared between the two entities and the data is the data that is…
m__
  • 135
  • 5
2
votes
0 answers

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-statistics/v2/.... The problem is I must send…
skavans
  • 121
  • 1
2
votes
2 answers

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows how it is done? Does anyone use nonce for csp…
MattyMerrix
  • 151
  • 6
2
votes
1 answer

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
Ayush Ambastha
  • 73
  • 6
2
votes
1 answer

If we use only client nonce and not server nonce, which attack vectors become possible?

As we all know, nonce is needed to prevent replay attacks. Everywhere I read about nonce, I see that client always fetches one from the server, and, to improve security even more, it also can add its own client nonce (cnonce). Just like on this…
Dmitry Frank
  • 195
  • 11
1 2
3
4 5 6