Questions tagged [zero-trust]
14 questions
5
votes
1 answer
Zero trust across micro-services using JWT
I am planning to implement JWT authentication on my micro-services to achieve zero trust architecture. User will generate a JWT token through front end micro-service. Each subsequent request will contain this JWT which will be forwarded to backend…
Saqib
- 151
- 4
4
votes
1 answer
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server does not threat the confidentiality of the…
Sibwara
- 1,316
- 7
- 19
2
votes
1 answer
Is uncompromisable obfuscated x86-64 execution possible?
I have a problem which has several layers;
Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus their resources too.
Actor A wants to run…
Shadowjonathan
- 123
- 4
2
votes
1 answer
Where custom auth source code fits into the micro-segmentation, zero-trust architecture
So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of small chunks, and at every connection point do some…
Lance
- 588
- 5
- 16
2
votes
2 answers
storing user's information without been able to access it
For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do:
encrypt users' passwords with RSA…
melanholly
- 168
- 5
1
vote
0 answers
Zero-Trust alternative to google sign-in, is this a feasable design?
I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was curious about designing something like google sign-in…
Gamer2015
- 707
- 4
- 12
1
vote
0 answers
Verify Encryption Key with Non-Interactive Zero-Knowledge Proof
I wrote an implementation of a non-interactive zero-knowledge proof system as outline in this research paper. As far as I can tell, it functions flawlessly as intended with text secrets such as authentication passwords.
# USER REGISTRATION:
#…
Goodies
- 135
- 1
- 8
1
vote
1 answer
Is the zero trust approach really so safe?
Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
Filipon
- 1,204
- 10
- 22
1
vote
0 answers
What is the current status of the zero trust model?
I read of the apprarently ambitious goals of the "zero trust model". Has it found success in practice or encountered problems? A link that may be useful is:…
Mok-Kong Shen
- 1,199
- 1
- 10
- 14
0
votes
1 answer
Is there a viable zero-knowledge approach for using oAuth to generate and manage private keys?
I've been doing a deep dive into how products like Web3Auth work under the hood and wonder if this is a viable approach to building applications where a user can have the convenience of using oAuth to generate and manage a private key. Additionally…
0
votes
1 answer
Trustless Application Architecture for end-users with secure enclaves
I am working on a project where I want to store end-user private data, but immediately this brings up the trust question of why a user would trust me to hold their data. I don't actually want to hold their data, but rather run an analysis on it and…
vin42tau
- 1
0
votes
0 answers
Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?
This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first understand whether the proposed mechanism is an apt…
Charles
- 1
- 1
0
votes
1 answer
Google approach to device security (BeyondCorp): managed devices and inference engine
I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google.
What kind of software would a managed device require? I assume that not…
Augusto
- 398
- 1
- 11
0
votes
1 answer
How can I securely generate secret-sharing/multisig keys on a p2p network?
I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key.
The problem lies in the generation of secret…
36bitavi
- 1