Algorithm is a set of step-by-step operations to be performed including calculations, data processing, and automated reasoning.

learn more… | top users | synonyms

322
votes
11answers
40k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
19
votes
7answers
4k views

Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
18
votes
4answers
2k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
9
votes
2answers
7k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
9
votes
4answers
766 views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. ...
8
votes
1answer
2k views

Identifying an unknown hash

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
7
votes
3answers
699 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
7
votes
5answers
649 views

How to prevent pay per show/click abuse?

We have a webapp. 3rd party websites put our banners on their pages (banner is a snippet of HTML). They are paid for it using "Pay per click" or "Pay per show" methods. So 3rd party website's owners ...
5
votes
5answers
3k views

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

I want to protect some registers by encrypting them without providing additional memory space. Is there a encryption algorithm that will maintain the length of the data to be encrypted? (i.e. ...
5
votes
2answers
2k views

Does chaos theory have any practical application in computer security?

Having learned about chaos theory at university some years ago, I've been curious ever since to know whether it has found any practical use in computing. Let me explain where I imagine it could be ...
5
votes
2answers
298 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm? This question ...
5
votes
1answer
242 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
5
votes
2answers
166 views

which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
4
votes
2answers
212 views

Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm

I had asked last year about the encryption claims by the web service called https://unseen.is. The very same service that had claims of "beyond army level encryption", "4096 bit keys" etc. This is the ...
4
votes
3answers
937 views

Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know ...
4
votes
2answers
97 views

Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, ...
4
votes
1answer
3k views

Is knowing the decrypted and encrypted data enough to find the key?

Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out? ...
3
votes
2answers
2k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
3
votes
2answers
1k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
3
votes
1answer
27 views

Standard for Generating Multiple WEP Keys From a Passphrase

I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full ...
3
votes
1answer
100 views

Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
3
votes
1answer
94 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
3
votes
2answers
292 views

Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
3
votes
3answers
55 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
3
votes
6answers
624 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
3
votes
0answers
90 views

Can I make a digital time capsule? [on hold]

Say I wanted to make a super awesome time capsule of some digital information. How would I encrypt it so that no one would be able to open it until a specified date? (E.g. 100 years from now.) At ...
3
votes
1answer
100 views

How to calculate cryptographic checksum using 3DES-outer-CBC mode

I want to calculate a cryptographic checksum using 3DES in outer CBC mode. As I know (and tried Googling also ) 3DES is an encryption algorithm, I'm not getting getting any information about how it ...
2
votes
4answers
764 views

Is 3DES outdated for message authentication code computing?

I am working in IT department of a bank, currently we use 3DES to compute MAC of packet, is that safe enough using 3DES? Should we use any other more modern algorithm?
2
votes
4answers
1k views

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?

I am new in cryptography, and while learning a different questions pop up in my mind. Here is one of them. For someone who has a key and ciphertext, is it possible to find out what encryption ...
2
votes
1answer
86 views

Aes encryption algorithm life time [closed]

How many years from now will we stop using aes encryption algorithm, as of now aes seems to be virtually immune to brute force attacks and not showing any weaknesses, will quantum or optical computing ...
2
votes
1answer
147 views

Which part is the longest when gerating RSA key pairs?

Whether I use openssll or gnutls's certtool, I end in a single threaded part which take several minutes. When I try to compile the libraries with auto-parallelizer advanced efficient tools. It sill ...
2
votes
2answers
113 views

Secure communication in SHTF

I am a prepper. I am preparing for a situation where there will be no rule of law and where I can't rely on the government for all my needs. This naturally involves storing food, water, and items for ...
2
votes
0answers
53 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
2
votes
0answers
79 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
1
vote
3answers
124 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
1
vote
3answers
310 views

Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
1
vote
1answer
2k views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
1
vote
2answers
75 views

Length of AES “plain text” when decrypted with wrong key

If I encrypt a text X using key A with the AES algorithms, and then decrypt the result using key B, would the obtained plain text Y length be the same as X's? If the answer is no, is there any ...
1
vote
4answers
100 views

About the AES algorithm key and ciphertext

I have the two following questions about the AES algorithm: A- Does the key need to follow any specific pattern apart from length or can it be a completely random string? So, if I select 16 random ...
1
vote
1answer
105 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
1
vote
1answer
58 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
1
vote
1answer
103 views

How does encryption strength make a difference to an attacker

Take for example I have my social security and other personal information stored as a string that I am trying to encrypt on my local drive. My first method of encrypting the string is to use a ...
1
vote
1answer
134 views

Why is a cookie's life extended after half the time has passed on a sliding expiration algorithm?

I'm coding my sliding expiration algorithm for Bearer tokens to mimic what's done by Microsoft on their FormsAuthentication logic, and reading their documentation they say (emphasis added) When ...
1
vote
1answer
126 views

Traffic anonymization through routing - software and algorithms

I stumbled upon an interview with "the grugq" in which he is talking about how hackers anonymize their traffic, i.e. hide their original ip address (- this is also what I will mean by "anonymizing" in ...
1
vote
1answer
158 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
1
vote
0answers
74 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
1
vote
0answers
55 views

Are there any “best practice” encryption tools for these classifications? [closed]

I appreciate there are different requirements when it comes to protecting data – however to try and get a better feel of the security landscape.... ...when considering the CIA triad: ...
1
vote
0answers
105 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
1answer
228 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
2answers
434 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...