Glossary - Revision history

Kaerez: /* Envelope Encryption */

2019-10-24T11:43:03Z

‎Envelope Encryption

2019-10-24T11:28:58Z

envelope encryption added

2018-03-28T17:57:59Z

‎Threat model: Added link to the threat model project

2017-02-12T00:34:33Z

‎QRLJacking

2017-02-12T00:34:07Z

‎Q

2015-05-01T15:21:50Z

‎0–9

2015-05-01T15:18:25Z

‎Authentication

2015-05-01T15:14:27Z

‎Authorization

2015-05-01T15:11:05Z

‎TLS

2015-05-01T15:10:51Z

‎Transport Layer Security

@@ Line 289: / Line 289: @@
 See also: [[#PKCS #1|PKCS #1 padding]].
 ===Envelope Encryption===
 A method of encrypting data/key using DEK (Data Encryption Key) which is then encrypted with the MEK (Master Encryption Key) or KEK (Key Encryption Key).
 In some uses, only the KEK is used and MEK is not used.

@@ Line 288: / Line 288: @@
 See also: [[#PKCS #1|PKCS #1 padding]].
 ===Encrypt-then-authenticate===
 When using a cipher to encrypt and a MAC to provide message integrity, this paradigm specifies that one encrypts the plaintext, then MACs the ciphertext. This paradigm has theoretically appealing properties and is recommended to use in practice.
@@ Line 310: / Line 314: @@
 ===Extended Euclidian algorithm===
 An algorithm used to compute the inverse of a number modulo “some other number.”
 ==F==
 ===Fingerprint===

@@ Line 689: / Line 689: @@
 {| class="wikitable"
-|colspan="2"|
+| colspan="2" |
-!colspan="3"|[[#Impact|Impact]]
+! colspan="3" |[[#Impact|Impact]]
 |-
-|colspan="2"|
+| colspan="2" |
 !Low
 !Medium
 !High
 |-
-!rowspan="4"|[[#Likelihood|Likelihood]]
+! rowspan="4" |[[#Likelihood|Likelihood]]
 |-
 !High
@@ Line 773: / Line 773: @@
 See also: [[#Anti-tampering|Anti-tampering]].
 ===Threat model===
 A representation of the system threats that are expected to be reasonable. This includes denoting what kind of resources an attacker is expected to have, in addition to what kinds of things the attacker may be willing to try to do. Sometimes called an architectural security assessment.
 ===Time of check, time of use problem===
 See also: [[#TOCTOU problem|TOCTOU problem]].

@@ Line 591: / Line 591: @@
 ===QRLJacking===
 QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on “Login with QR code” feature as a secure way to login into accounts. In a simple way, In a nutshell victim scans the attacker’s QR code results of session hijacking.
 ==R==

@@ Line 589: / Line 589: @@
 A system that provides a means for establishing trust as to what identity is associated with a public key. Some sort of Public Key Infrastructure (PKI) is necessary to give reasonable assurance that one is communicating securely with the proper party, even if that infrastructure is ad hoc”
 ==Q==
 ==R==
 ===RA===

@@ Line 7: / Line 7: @@
 {{SecureSoftware}}
 ==A==
 ===Access Control List===

@@ Line 50: / Line 50: @@
 ===Authentication===
-The process of verifying that someone or something is the actual entity that they claim to be.
+The process of verifying that someone or something is the actual entity that they claim to be.  Authentication is what happens when you log into a system.  It compares your credentials (often user name and password) with a previously established known value such that the system can know that you are who you say you are.  For sensitive systems, there is a trend toward using two factor authentication (2FA) which essentially means that users must supply two different secrets, usually one is a password (something they know) and the other is a pin supplied via text (verifying something they have).
 ===Authorization===

← Older revision		Revision as of 15:14, 1 May 2015
Line 53:		Line 53:

	===Authorization===		===Authorization===
		+	Authorization is the process of determining whether an authenticated subject (a user) can see, change, delete or take other actions upon data. For example, if you log into a time keeping application, submit your timesheet and then your boss approves it, the act of logging in is authenticating, the act of filling out your timesheet and submitting should only be something your user is authorized to do and approving the timesheet is something only the boss is authorized to do. Authorization is tied to both #4 and #7 of the 2013 OWASP Top 10.

	==B==		==B==

@@ Line 783: / Line 783: @@
 See also: [[#Race condition|Race condition]].
-===Transport Layer Security===
+===Transport Layer Security (TLS) ===
 The successor to SSL, a protocol for establishing secure channels over a reliable transport, using a standard X.509 Public Key Infrastructure for authenticating machines. The protocol is standardized by the IETF.
 See also: [[#Secure Socket Layer|Secure Socket Layer]].
 ===Triple DES===
 A variant of the original Data Encryption Standard that doubles the effective security. Often abbreviated to 3DES. The security level of 3DES is still considered to be very high, but there are faster block ciphers that provide comparable levels of security — such as AES.