Verify that stateless session tokens use digital signatures, encryption, and other countermeasures to protect against tampering, enveloping, replay, null cipher, and key substitution attacks.

spyd3r / merlin

0 stars 0 forks source link

Verify that stateless session tokens use digital signatures, encryption, and other countermeasures to protect against tampering, enveloping, replay, null cipher, and key substitution attacks. #115

Open spyd3r opened 5 years ago

syalosovetskyi commented 4 years ago

what it is enveloping attack?

jjedele commented 3 years ago

Googling for "enveloping attack" because I red it in the ASVS brought me to this issue :D Also I'm not sure what a null cipher attack is and how to protect from it. Is it about cipher algorithm negotiation during the handshake of TLS or something?