#3des

[iseedeadpackets]

Verifone Boot Screen. Notice that it uses a 3DES key.

[ahiijny]

Triple DES (3DES) is a symmetric-key block cipher that was formally introduced in 1998. 3DES attempts to improve upon the security of the older 56-bit DES cipher by applying DES three times to each data block. However, 3DES is vulnerable to a meet-in-the-middle attack, so the effective security for 3DES is limited to 112 bits.

[binaryinformatics-blog]

Here's What No One Tells You About Symmetric Key Algorithm

As we begin the 21st century, we find secure communication a necessary part of our everyday lives. A few examples include e-commerce, stock trading from handheld devices, phone calls or facsimiles involving private or proprietary information, and secure money transfers or withdrawals throughout the world.

A few examples include e-commerce, stock trading from handheld devices, phone calls or facsimiles involving private or proprietary information, and secure money transfers or withdrawals throughout the world.

[gslin]

DHS 要求郵件系統都必須使用 STARTTLS、DMARC，並且全面禁用 RC4 與 3DES

DHS 要求郵件系統都必須使用 STARTTLS、DMARC，並且全面禁用 RC4 與 3DES

在 Twitter 上看到 18F 貼了 DHS 的新規定：「Enhance Email and Web Security」。 Just launched by our friends at DHS! A new federal directive to require DMARC and STARTTLS, and to cut RC4 and 3DES: https://t.co/gp5G7A6LMA pic.twitter.com/6V4UJ9sGIo — 18F (@18F) October 16, 2017 郵件系統的部份，要求要有 STARTTLS，並且設定 SPF 與 DMARC。另外禁用 SSLv2 與 SSLv3，以及 RC4 與 3DES。 網站的部份，則是要求 HTTPS 以及 HSTS。另外也與郵件系統一樣禁用 SSLv2、SSLv3，以及 RC4 與 3DES。…

View On WordPress

[gslin]

SWEET32：攻 Blowfish 與 3DES

SWEET32：攻 Blowfish 與 3DES

最新的攻擊算是實戰類的攻擊，理論基礎以前都已經知道了，只是沒有人實際「完成」。算是近期少數直接對演算法的攻擊，而這些演算法剛好還是被用在 TLS 與 OpenVPN 上，所以嚴重性比較高：「SWEET32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN」。 攻擊的條件是 block cipher 的 block size，而非 key length，所以就算是 256 bits 的 Blowfish 也一樣也受到影響。 這次順利打下 Blowfish 與 3DES。這兩個 cipher 的 block size 都是 64 bits，所以對於 birthday attack 來說只要 232 就可以搞定： This problem is well-known by cryptographers, who…

View On WordPress

[antonbobilyovjln-blog]

CISCO 836 SERIES IOS IP-FW PLUS 3DES ( S836CHPK9-12211YV= )

Download CISCO 836 SERIES IOS IP-FW PLUS 3DES ( S836CHPK9-12211YV= )

You know what I asked you just now. I can imagine theyd suit you, why. You will be out of it all, after a pause. A note from Japp. I am quite sure (because she has told me so), giving way to pure joy?

[gslin]

GitHub 預定再兩個星期後廢止 HTTPS 連線的 RC4

GitHub 預定再兩個星期後廢止 HTTPS 連線的 RC4

GitHub 在「Improving GitHub’s SSL setup」這邊開頭就提到要拔掉 RC4：

To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the GitHub API on January 5th 2015.

看了一下日曆，算一算其實意思就是「放完假的星期一我們就來拔 RC4」XDDD

雖然 GitHub 的人是說 Windows XP + IE8 會沒辦法用，不過翻了「Qualys SSL Labs – Projects / User Agent Capabilities: IE 6 / XP」這頁，手動打開 TLS 1.0 後應該還有…

View On WordPress

[gslin]

NCCC (聯合信用卡處理中心) 的網站不支援 AES 加密...

NCCC (聯合信用卡處理中心) 的網站不支援 AES 加密…

看到廉價航空機票在特價跑去刷，結果刷了兩次都死在聯合信用卡處理中心的 acs.nccc.com.tw 畫面出不來。突然想到我把 RC4 關掉了，該不會是這種原因吧…

跑去「SSL Report: acs.nccc.com.tw (210.61.215.16)」這邊一看，果然是不支援 AES：

抱頭痛哭啊… 只好 rollback 回來 @_@

View On WordPress