It would all depend on the message content. If the content is digitally
signed by the parties, you have a way of verifying (and doing audits
later) them. That is AFAIK!
Neil Humphreys wrote:
Ashu
Sorry another typo - I meant to say
2, I am hoping the certificates take of 2. Which just leaves 1
untackled by NULL-SHA. The question is, is there anything else weak
about NULL-SHA other than the lack of privacy.........
thanks again,
Neil
-----
Original Message -----
Sent:
Wednesday, August 13, 2003 9:19 PM
Subject:
Re: Cipher Suites explanation
Neil Humphreys wrote:
My app is a listening server
with 2 ports. The less secure one is for performance, when it doesn't
matter if someone sees the data being sent, so it is not worth
encrypting/decrypting.
The NULL-SHA checksum should
take care of requirement 3 then - and the fact that it is SSL (and uses
certificates) takes care of 1??? Apart from encrypting the data itself,
is there any other reason why NULL-SHA is insecure ??
Your requirement 1 is secrecy (encryption). For encryption you need
some form of encryption method to encrypt your plaintext. When there is
no encryption method how can you encrypt something and achieve secrecy
through it?
Ashu
I
changed the subject line so that it makes more sense!
Neil Humphreys wrote:
Hi all,
I have an app that requires
2 types of secure communications:
-one fully secured channel
with encrypted data
-one fully secured channel,
*except* that the data itself is not secret, and does not need any
encryption.
Do you mean to say that you have something like a secured protocol
(like a pipe) in which you can send data of another protocol (like
water inside a pipe)? As far as I know you secure the channel by
encoding your entire data stream.
Hence, I would be grateful
if someone could spell out what the following cipher suite provides:
DES-CBC3-SHA
Digital Encryption Standard-Cipher Block Chaining-Secured Hash
(Algorithm)
It means that the encryption method is DES (which is really risky to
use nowadays unless u don't have any other choice). Cipher Block
chaining is a method of encryption using IVs in which your cipher text
is arrived by using the previous block. SHA is a checksum algorithm.
that the following one
doesn't:
NULL-SHA
No encryption (meaning worthless) + only checksum of the data. I maybe
wrong so please correct me.
with regards to the
following security features:
1. secrecy (encryption)
2. authentication
(sender/receiver validation)
3. prevention of message
tampering
One other thing .. once the
handshake is over, is there much CPU/network bandwidth overhead in
using NULL-SHA, compared with unsecured tcp?
--
http://www.jaiashu.com/
-------------------------------------
"I would like to change the world,
but they wont tell me the source code"
--
http://www.jaiashu.com/
-------------------------------------
"I would like to change the world,
but they wont tell me the source code"
|
