37 ms·
Sending an ssl/tls request also requires some entropy! It's needed to avoid MITM and replay attacks. A bit more info: https://security.stackexchange.com/questi
by pronoiac 5y ago
Sending an ssl/tls request also requires some entropy! It's needed to avoid MITM and replay attacks.
A bit more info: https://security.stackexchange.com/questions/157684/why-does-the-ssl-tls-handshake-have-a-client-random https://security.stackexchange.com/questions/157684/why-does...
- simulate-me 5y agoIt doesn't need to be encrypted, just signed by the entropy source. The signature should be verifiable without entropy.
- Hello71 5y agoHow does that prevent replay attacks?
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- simulate-me 5y agoHmm good point. I guess you need entropy for a nonce.
- paulclinger 5y agoMaybe include and sign a timestamp?
- pronoiac 5y agoSorta nice, but that wouldn't avoid replay issues.
- deleted 5y ago[deleted]