From 2e69beebbab89dd23dd8c81147c0313eafa9b78a Mon Sep 17 00:00:00 2001 From: Karenzz Date: Thu, 25 May 2023 19:17:40 +0200 Subject: [PATCH] Update page 'OWASP test questions_Karen' --- OWASP test questions_Karen.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/OWASP test questions_Karen.md b/OWASP test questions_Karen.md index f9cd139..4ce6411 100644 --- a/OWASP test questions_Karen.md +++ b/OWASP test questions_Karen.md @@ -66,12 +66,17 @@ There are also some other reasons, such as the session ID length as sequential s * What symmetric and non-symmetric ciphers does your browser use when connecting to the following web sites: www.google.com www.neverssl.com www.sayweee.com - - + * www.google.com: The connection of this site is encryped and autheticated using QUIC, X25519, and AES_128_GCM * What is the currently recommended strength, in bits, for AES when used in a TLS server? + +*The currently recommended strength for AES when used in a TLS server is 128 bits.* + * Describe what an export-grade cipher is. Does this concept still apply in this day and age? Why or why not? + +*An export-grade cipher refers to a cryptographic algorithm that was intentionally weakened by design or limited in key size to comply with cryptographic export regulations that were prevalent in the late 20th century. * + * Describe the circumstances under which any web browser released after 2020 would accept a SHA-1 signed TLS certificate, if any. * Is an extended validation TLS certificate more cryptographically secure than a normally issued TLS certificate? * What is Let's Encrypt, and what incident caused the project to be founded?