# Tagged Questions

Algorithm is a set of step-by-step operations to be performed including calculations, data processing, and automated reasoning.

44k views

### Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
4k views

### Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
2k views

### Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
2k views

### Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
8k views

### Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
800 views

### How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. a-z,...
2k views

### Identifying an unknown hash

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
749 views

### Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
684 views

### How to prevent pay per show/click abuse?

We have a webapp. 3rd party websites put our banners on their pages (banner is a snippet of HTML). They are paid for it using "Pay per click" or "Pay per show" methods. So 3rd party website's owners ...
397 views

### How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an n-bit password in time O(n^(log n)), is there need for alarm? This question arises ...
3k views

### Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

I want to protect some registers by encrypting them without providing additional memory space. Is there a encryption algorithm that will maintain the length of the data to be encrypted? (i.e. ...
2k views

### Does chaos theory have any practical application in computer security?

Having learned about chaos theory at university some years ago, I've been curious ever since to know whether it has found any practical use in computing. Let me explain where I imagine it could be ...
251 views

### What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
279 views

### Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm

I had asked last year about the encryption claims by the web service called https://unseen.is. The very same service that had claims of "beyond army level encryption", "4096 bit keys" etc. This is the ...
1k views

### Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know ...
4k views

### Is knowing the decrypted and encrypted data enough to find the key?

Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out? ...
1k views

### How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
107 views

### Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, '...
200 views

### which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
2k views

### For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?
2k views

### How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
33 views

### Standard for Generating Multiple WEP Keys From a Passphrase

I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full ...
143 views

### Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
122 views

### Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
349 views

### Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
79 views

### Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
673 views

### Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
100 views

### Can I make a digital time capsule? [closed]

Say I wanted to make a super awesome time capsule of some digital information. How would I encrypt it so that no one would be able to open it until a specified date? (E.g. 100 years from now.) At ...
232 views

### How to calculate cryptographic checksum using 3DES-outer-CBC mode

I want to calculate a cryptographic checksum using 3DES in outer CBC mode. As I know (and tried Googling also ) 3DES is an encryption algorithm, I'm not getting getting any information about how it ...
1k views

### Is 3DES outdated for message authentication code computing?

I am working in IT department of a bank, currently we use 3DES to compute MAC of packet, is that safe enough using 3DES? Should we use any other more modern algorithm?
2k views

### Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
126 views

### Aes encryption algorithm life time [closed]

How many years from now will we stop using aes encryption algorithm, as of now aes seems to be virtually immune to brute force attacks and not showing any weaknesses, will quantum or optical computing ...
166 views

### Which part is the longest when gerating RSA key pairs?

Whether I use openssll or gnutls's certtool, I end in a single threaded part which take several minutes. When I try to compile the libraries with auto-parallelizer advanced efficient tools. It sill ...
144 views

### How does encryption strength make a difference to an attacker

Take for example I have my social security and other personal information stored as a string that I am trying to encrypt on my local drive. My first method of encrypting the string is to use a ...
139 views

### Secure communication in SHTF

I am a prepper. I am preparing for a situation where there will be no rule of law and where I can't rely on the government for all my needs. This naturally involves storing food, water, and items for ...
58 views

### Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
131 views

### CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
186 views

### Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
336 views

### Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
72 views

### How can i Identify and use hash function given enough text and their hash?

So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords.. Now users will provide me with the plain text password and ...
141 views

### Length of AES “plain text” when decrypted with wrong key

If I encrypt a text X using key A with the AES algorithms, and then decrypt the result using key B, would the obtained plain text Y length be the same as X's? If the answer is no, is there any ...
159 views

### About the AES algorithm key and ciphertext

I have the two following questions about the AES algorithm: A- Does the key need to follow any specific pattern apart from length or can it be a completely random string? So, if I select 16 random ...
64 views

### Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
112 views

### How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
160 views

### Why is a cookie's life extended after half the time has passed on a sliding expiration algorithm?

I'm coding my sliding expiration algorithm for Bearer tokens to mimic what's done by Microsoft on their FormsAuthentication logic, and reading their documentation they say (emphasis added) When ...
155 views

### Traffic anonymization through routing - software and algorithms

I stumbled upon an interview with "the grugq" in which he is talking about how hackers anonymize their traffic, i.e. hide their original ip address (- this is also what I will mean by "anonymizing" in ...
170 views

### Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
53 views

### How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...