Cryptanalysis is the part of cryptology dedicated to the mathematical analysis of the weaknesses of cryptographic algorithms, the goal being to defeat some of the security properties that the algorithm should fulfill, e.g. decrypting data which has been symmetrically encrypted with substantially ...
4
votes
1answer
121 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
-3
votes
2answers
83 views
how to identify plain text from cipher [closed]
I am trying to find what encryption algorithm has been used in this code
original text: 11011698
encrypted text/cipher: uIC4hZFECIAYMi%20FWxamjQ==
original text:11008569
encrypted text/cipher: ...
1
vote
2answers
139 views
How can i calculate the number of possible passwords?
I have found a flaw in a site where the password reset feature resets passwords in the following format
UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter
...
5
votes
7answers
467 views
How easy is it to find a password in a huge text file?
Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
64
votes
8answers
4k views
How would one crack a weak but unknown encryption protocol?
I was reading this interesting question:
Is my developer's home-brew password security right or wrong, and why?
It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
2
votes
1answer
123 views
Legality and ethics of cryptanalysis on password hashes
I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
3
votes
2answers
137 views
Remedy for not having filled the disk with random data?
Filling a large HDD with /dev/urandom prior to encryption can be extremely slow (even with netcat, multiple instances in parallel, etc) and for this reason I'm sure a lot of users skip this advice ...
3
votes
2answers
200 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
0
votes
2answers
286 views
Tool for generating MD4 collisions
There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these.
Uptill now I have used tools like John the Ripper ...
2
votes
2answers
254 views
How to test security of an encryption algorithm?
What are the standards methods to test the quality of an encryption algorithms. Secondly if i am trying to implement an encryption algorithm then what practices should i adopt?
1
vote
2answers
173 views
Determine encoding/hashing methods used based on knowing the input and output only?
If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing ...
6
votes
1answer
151 views
Identifying, analyzing, and predicting weak session cookies
To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
1
vote
2answers
74 views
Encryption app stroring the password
The encryption app that we are using seems to generate the same output for the same input. That is bad right? I'm not smart enough to understand the scheme being used though.
The header of each ...
0
votes
1answer
154 views
How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?
I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !!
7-zip uses the AES-256 encryption algorithm in ...
1
vote
1answer
193 views
Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm? [duplicate]
Possible Duplicate:
Are different hash algorithms ever used together?
For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to ...
9
votes
2answers
584 views
Estimating the size of a rainbow table
What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
0
votes
1answer
217 views
any small idea to decode this algortihm from php script [closed]
So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) .
The encoded result $xId_campaign_encoded from the php script has ...
0
votes
1answer
137 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
2
votes
2answers
280 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
7
votes
6answers
558 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
1
vote
2answers
453 views
How does a brute force attack actually determine it has succeeded? [duplicate]
Possible Duplicate:
If someone breaks encryption, how do they know they're successful?
First off, this is not about cracking hashed passwords. I know that a brute-force or dictionary ...
4
votes
2answers
278 views
Zero padding in HMAC
Section 2 of RFC 2104 defines the key used in HMAC should be padded with zero bytes up to the block length of the underlying hash algorithm.
Isn't this a potential security vulnerability since any key ...
2
votes
1answer
125 views
Does knowing encrypted information make it easier to find an unknown key?
I'm curious if knowing the exact content of an encrypted message or several messages makes it theoretically any easier to discover the encryption key. Does this speed up a brute force attack in any ...
1
vote
3answers
327 views
Best protection against a “chosen-ciphertext” attack?
What is the best protection against a "chosen-ciphertext" attack when transmitting (=streaming) secured (=crypted) data via networks using the TCP protocol?
4
votes
2answers
2k views
Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?
I'm not talking about decrypting the connection while the SSL/TLS is happening (MITM) but after the connection is closed and I have a pcap file of the entire negotiation/data transfer process.
How ...
1
vote
2answers
378 views
How effective have statistical methods been at breaking encryption?
If we look at how statistical engines run on-line translators, and how they are built, we see that they look at a new language and run a statistical model over it searching for what's probably the ...
2
votes
3answers
768 views
what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?
I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).
I have the salt and hash.
the password contains the symbols - ...
5
votes
2answers
327 views
Length of CSRF Token
Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
14
votes
6answers
4k views
Where can I learn cryptography/cryptanalysis the hard way, without going to school ? Any good book?
I'm not so bad at mathematics:
I know what are p-list and p-combinations, I know matrix algebra, I know what a XOR is, I know how to tell if number is a prime, etc: I'm not the programmer who hates ...
5
votes
2answers
322 views
NSA crypto Suite B - historical
I'm looking for information on what NSA suggested for use in commercial systems in past times. 90's and early 2000's.
I'm mainly interested in PKI and symmetric cyphers for SSL and file/disk ...
12
votes
3answers
814 views
What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?
Why can SHA-1 be considered a secure hash function? That's something I still wonder about.
I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
4
votes
3answers
331 views
Hashed passwords - How many variations of rainbow tables?
First off...I passed the CISSP exam. WOOOO. I had to get that out. GCIH and CEH by Sept. 11'
So, while studying for the technical side of things, I see that there are rainbow tables. They are ...
2
votes
2answers
316 views
GOST cipher test vectors
Does anyone know where to find test vectors for the GOST cipher? I have been looking around for quite some time, and have been unable to find anything. I know that the sboxes are dependent on the ...
-6
votes
2answers
238 views
Would this kind of encryption be good at anything?
I have put much thought into this very simple algorithm and I have no clue if it was thought before... But I think it should have.
I also know nothing about other encryption algorithms so I can't tell ...
5
votes
3answers
1k views
Vigenere Cipher - help with decryption (by hand)
So this is a Vigenere cipher-text
EORLL TQFDI HOEZF CHBQN IFGGQ MBVXM SIMGK NCCSV
WSXYD VTLQS BVBMJ YRTXO JCNXH THWOD FTDCC RMHEH
SNXVY FLSXT ICNXM GUMET HMTUR PENSU TZHMV LODGN
MINKA DTLOG HEVNI ...
16
votes
2answers
12k views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
1
vote
3answers
446 views
Are the encryptions “broken” with great computing power?
http://www.dwavesys.com/en/pressreleases.html#lm_2011
Lockheed Martin Corporation (NYSE: LMT) has entered into an agreement to purchase a quantum computing system from D-Wave Systems Inc.
I'm ...
9
votes
2answers
2k views
Cracking a linear congruential generator
I was recently listening to the security now podcast, and they mentioned in passing that the linear congrunential generator (LCG) is trivial to crack. I use the LCG in a first year stats computing ...
16
votes
1answer
732 views
WPA significantly less secure than WPA2?
I understand at least theoretically WPA2 is more secure than WPA, but in practice does it make any difference which one you use? From what I know there are no known attacks for either except for ...
5
votes
1answer
227 views
How valid is the concern over narrow pipe hash function designs?
Narrow pipe hash function designs have recently come under fire, particularly in reference to some SHA-3 candidates. Is this criticism valid? Can it be explained more simply than this paper does?
I'm ...
25
votes
8answers
46k views
How to determine what type of encoding/encryption has been used?
I've looked on this site and on SE. but i couldn't get a handle on this.
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which ...
3
votes
2answers
304 views
How to optimize compressed file cracking?
I'm currently doing research on cracking encrypted, compressed files (specifically: uif, zip, 7z, dmg). Looking at all the utilities out there, it seems the time it takes to crack something is ...
6
votes
2answers
4k views
The new CCMP attack against WPA/WPA2 PSK
The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
8
votes
3answers
1k views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
5
votes
4answers
3k views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
15
votes
3answers
1k views
MySQL OLD_PASSWORD cryptanalysis?
The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
11
votes
2answers
413 views
Is a large number of RSA-encrypted files a vulnerability?
Would having a large number (10^4) of RSA encrypted files make it easier for an attacker to find my private RSA key?
Update: These files would be available to the attacker, and perhaps the content of ...
14
votes
5answers
7k views
Should RSA public exponent be only in {3, 5, 17, 257 or 65537} due to security considerations?
In my project I'm using the value of public exponent of 4451h. I thought it's safe and ok until I started to use one commercial RSA encryption library. If I use this exponent with this library, it ...
3
votes
1answer
167 views
What is encryption method for the 3rd part of the Kryptos text?
http://fr.wikipedia.org/wiki/Kryptos_%28sculpture%29
http://en.wikipedia.org/wiki/Kryptos
I read the Kryptos wikipedia page, is says it's crypted with a "modular transposition of lines and columns".
...
