Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

1
vote
1answer
23 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
5
votes
1answer
66 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
7
votes
2answers
297 views
+100

How can I explain “zero knowledge proof” to an end user?

A ZKP allows proof of knowing the answer to a secret, without actually disclosing what that answer is. Is there any analogy that can help people put this concept into everyday practice? A "lie to ...
0
votes
1answer
44 views

Sharing a common public and private SSH keys for a cluster of machines

I guess this is way to settle an internal debate I am having with myself. In my provisioning process, I am wanting to share a common public and private ssh keys for each machine in a clusters, ...
2
votes
0answers
74 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
0
votes
0answers
36 views

Encryption and decryption of plain text using stream cipher algorithm [on hold]

As we know that in stream cipher data are encrypted bit by bit as in block cipher block by block. So in stream cipher key will generate as depend on plain text. So I have doubt that if in any stream ...
0
votes
0answers
17 views

Is there mobile app for encryption a voice thru the common gsm call? [closed]

Is there a program that encrypts the voice of the first person then it will be decrypted on the other side of conversation and so on? Or maybe something like that. The main point is encryption on the ...
1
vote
1answer
31 views

Is it possible to convert a gpg key to a different encryption algorithm [duplicate]

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
22
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
1
vote
2answers
67 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
4
votes
1answer
39 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
5
votes
1answer
64 views

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...
2
votes
1answer
79 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
2
votes
0answers
32 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
4
votes
2answers
86 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...
2
votes
1answer
65 views

Hashing algorithm for cryptsetup

I will encrypt my SSD using cryptsetup and I would like to know which hashing algprithm to use. First of all, cryptsetup benchmark: PBKDF2-sha256 262144 iterations per second PBKDF2-sha512 ...
2
votes
0answers
26 views

Reference Implementation for Shoup's ECIES?

ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some ...
23
votes
2answers
2k views

What is the purpose of frequently rotating TLS certificates without changing underlying keys?

I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
0
votes
1answer
27 views

Block size of CTR, CFB and OFB mode of AES in openssl

I am using openssl library. In all documents and webpages it is written that the block size is 128 bites(common for all AES modes). But what I observed in openssl is, for CTR, CFB and OFB modes the ...
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
2answers
76 views

Is `arc4random` secure enough?

I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
3
votes
2answers
1k views

Chrome showing cryptography as 'obsolete'

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
0
votes
1answer
42 views

Which parameters can I use to analyse my cipher? [closed]

I have made a new methodology for a symmetric key cryptography in which I have used matrix operations, a boolean function and ASCII conversion. Please suggest me the possible parameters to judge my ...
2
votes
0answers
51 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
3
votes
2answers
114 views

How secure is MD5 for TLS message authentiaction?

I was recently viewing a website and saw its certificate info as follows: Given that MD5 is badly broken and not recommended for hashing, how good is it for use in TLS? And why?
0
votes
2answers
211 views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...
0
votes
1answer
90 views

RSA key sizes v/s public key sizes

I am new to cryptography. I have an api provided by a bank. The banks says that they are using RSA algorithm with 2048 bits. We used this api first to get the public key. Here is the sample public ...
0
votes
0answers
4 views

Crack linear congruential generator knowing every other word in sequence [migrated]

I need to crack one of the example of linear congruential generator. I have Xn+1 = (A * Xn + B) mod m and i know every other word in output sequence: ..., 3158, ..., 1888, ..., 1285, ..., 1744, ...
-4
votes
1answer
35 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...
5
votes
2answers
429 views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
3
votes
0answers
272 views

What are the vulnerabilities of this homemade encryption algorithm? [migrated]

I decided to program a relatively trivial encryption algorithm in my downtime. This algorithm takes a seed from a user (supports floating point seeds), and then adds 1 to the seed for every iteration ...
2
votes
1answer
69 views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
1
vote
2answers
269 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, and I want to make sure that each phone's service isn't abused. To that end I need ...
2
votes
1answer
73 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
-1
votes
1answer
76 views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function ...
2
votes
1answer
39 views

Subject verification of certificates

Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?
0
votes
1answer
122 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
1
vote
1answer
36 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
129 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
0
votes
1answer
86 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
0
votes
2answers
155 views

Untraceable Digital Cash?

I have read some articles regarding digital cash with untraceable(Here). Their protocol is provided below Withdrawal: Alice creates an electronic coin and blinds it. Alice sends the blinded ...
1
vote
1answer
25 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
0
votes
1answer
32 views

Which stream ciphers are supported in am335x cryptographic accelerator?

I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I ...
13
votes
4answers
12k views

Google Chrome “Your connection to website is encrypted with obsolete cryptography”

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
2
votes
3answers
153 views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
0
votes
1answer
94 views

How can I tell if my client has been infected with CryptoWall?

Today a client ran a file they believed to be something else, they said a black window appeared, so I checked the code to see what it ran in CMD, but can't quite work out what it's doing. I've just ...
0
votes
1answer
96 views

Can you recover the password from ZipCrypto encrypted ZIP file?

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily. Now the question is, can you also get at the password (assume this is a very long, very high ...
2
votes
1answer
165 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
7
votes
4answers
325 views

How to check randomness of random number generators?

Assume that I have a smart card that returns an 8 byte (for example) random value on reception of a command. The question is that: How I can check if this value is really random? (I don't have any ...