Tag Archives: Brute-Force

Passwords vs. Private Keys

2018-08-01Authentication, Crypto, Password, SSHAuthentication, Brute-Force, Certificate, Crypto, Entropy, IPsec, Login, Password, Pre-Shared Key, PSK, Public KeyJohannes Weber

It is widely believed that public/private keys or certificates are “more secure” than passwords. E.g., an SSH login via key rather than using a password. Or a site-to-site VPN with certificate authentication rather than a pre-shared key (PSK). However, even certificates and private keys are not unlimited secure. They can be compromised, too, since the public-key cryptography only implies that private keys won’t be exposed if a brute-force attack is nearly impossible.

So, what’s the real security level of passwords compared to public keys/certificates?

Continue reading Passwords vs. Private Keys →

Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve)

2015-02-13Crypto, Fortinet, IPsec/VPN, Juniper NetworksBits of Security, Brute-Force, Diffie-Hellman, ECC, Elliptic Curve Cryptography, FortiGate, Fortinet, IKE, IPsec, Juniper ScreenOS, Perfect Forward Secrecy, PFS, Site-to-Site VPNJohannes Weber

Similar to my test with Diffie-Hellman group 14 shown here I tested a VPN connection with elliptic curve Diffie-Hellman groups 19 and 20. The considerations why to use these DH groups are listed in the just mentioned post – mainly because of the higher security level they offer. I tested the site-to-site IPsec connections with a Juniper ScreenOS firewall and a Fortinet FortiGate firewall. (Currently, neither Palo Alto Networks nor Cisco ASA support these groups.)

Continue reading Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve) →

Considerations about IPsec Pre-Shared Keys

2015-01-19Authentication, Crypto, IPsec/VPNBrute-Force, IKE, IPsec, Man-in-the-Middle, Pre-Shared Key, PSK, Site-to-Site VPN, VPNJohannes Weber

Pre-shared keys (PSK) are the most common authentication method for site-to-site IPsec VPN tunnels. So what’s to say about the security of PSKs? What is its role for the network security? How complex should PSKs be? Should they be stored additionally? What happens if an attacker catches my PSKs?

I am listing my best practice steps for generating PSKs.

Continue reading Considerations about IPsec Pre-Shared Keys →

FileZilla Server Bug: Autoban does not work with IPv6

2014-05-14IPv6, Network, SecurityBrute-Force, Bug, FileZilla Server, IPv6, PasswordJohannes Weber

While testing with the new release of Hydra against my own FTP server from FileZilla, I recognized that the autoban feature from FileZilla does not work for IPv6 connections. If there are multiple failed login attempts from an IPv4 address, FileZilla Server correctly blocks that IP. That is: Hydra stops testing passwords since it is not able to connect to the server anymore. However, when using IPv6, the FileZilla server generates the same error message (“421 Temporarily banned for too many failed login attempts”), but new connections from the same IPv6 address are still possible.

Here are my test results:

Continue reading FileZilla Server Bug: Autoban does not work with IPv6 →

Site-to-Site VPNs with Diffie-Hellman Group 14

2014-04-10Crypto, IPsec/VPNBits of Security, Brute-Force, Diffie-Hellman, IKE, IPsec, Juniper ScreenOS, Palo Alto Networks, Perfect Forward Secrecy, Site-to-Site VPNJohannes Weber

When talking about VPNs it is almost always clear that they are encrypted. However, it is not so clear on which security level a VPN is established. Since the Perfect Forward Secrecy (PFS) values of “DH group 5” etc. do not clearly specify the “bits of security”, it is a misleading assumption that the security is 256 bits due to the symmetric AES-256 cipher. It is not! Diffie-Hellman group 5 has only about 89 bits of security…

Therefore, common firewalls implement DH group 14 which has a least a security level of approximately 103 bits. I tested such a site-to-site VPN tunnel between a Palo Alto and a Juniper ScreenOS firewall which worked without any problems.

Continue reading Site-to-Site VPNs with Diffie-Hellman Group 14 →

Password Policies – Appropriate Security Techniques

2013-11-26Password2-Factor Authentication, Brute-Force, Complexity, Keylogger, Malware, Man-in-the-Middle, Password, Policy, Security vs. Usability, Session HijackingJohannes Weber

How are passwords stolen? What are common password flaws? What are the security techniques to enhance the security of passwords respectively the security of the login-services? What authentication methods provide long-term security? How often should a password be changed? Which methods achieve good security while not being too complicated to be used by end-users?

This blog post discusses several methods of how passwords are stolen and provides approaches of how login-services can be secured.

Continue reading Password Policies – Appropriate Security Techniques →

Password Strength/Entropy: Characters vs. Words

2013-07-30PasswordBrute-Force, Complexity, Dictionary Attack, Entropy, Passphrase, Password, Random, xkcdJohannes Weber

This is a mathematical post which is related to the xkcd 936 comic about password strength. The central question is: What is better for passwords? A password containing a few random characters or a passphrase containing a (less) few random words? Here comes a mathematical discussion.

Continue reading Password Strength/Entropy: Characters vs. Words →

Weberblog.net

IT-Security, Networks, IPv6, VPN, DNSSEC, NTP