Cryptography is about ensuring, in a computerized context, the following properties: confidentiality: some information must be stored or transfered without permitting unauthorized entities to read it; integrity: some information must be stored or transfered without allowing any alteration by an ...
0
votes
0answers
21 views
PGP encryption/signature with BouncyCastle
I've implemented PGP encryption and signature using BouncyCastle on Java. It works, but all the examples I'm based on have hardcoded the algorithms for symetric encryption, hashing and compression.
...
2
votes
2answers
53 views
Is it true that encryption bit “strength”, although numerically identical, may actually be different depending on the algorithm?
I was reading recently that for AES, the encryption strength is actually the key size/length, so 128-, 192- or 256-bit. While, for SHA-2, the encryption strength is measured against the message digest ...
4
votes
3answers
69 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
-1
votes
0answers
28 views
How to find the encryption of a cipher and apply it to another key
Guys Iam very new to cryptography so please help me out with this one
I have a Question Key-1 which + some encryption gives Answer key-1. I have to find the encryption to apply it to another Question ...
1
vote
1answer
106 views
Is using the same RSA key pair for both (signing and encryption) & (signing and encryption) a bad idea? [closed]
Possible Duplicate:
Why should one not use the same asymmetric key for encryption as they do for signing?
I'm new to IT Security. I still can't figure out why using the same RSA key pair ...
4
votes
2answers
119 views
MAC vs Encryption
I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't?
I know that ...
2
votes
1answer
106 views
Is BCrypt enough when saving a password into a database?
In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted).
...
1
vote
2answers
121 views
Can we prevent a man-in-the-middle attack with symmetric-key cryptography?
Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and ...
1
vote
1answer
56 views
SRP 6a implementation C#
I'm trying to implement the SRP crypto; 6a. However I'm not familiar with the cryptography and it's computing. I'm using the public implementation of the BouncyCastle lib, but I have no idea how it ...
1
vote
0answers
50 views
Creating an encryption key from several other keys and using hash functions [migrated]
When we want to combine two (or probably more) keys to create a single encryption key that relies on all of them, what is the proper method for doing that? Simple XOR? Using hash functions? ...
I ...
11
votes
3answers
297 views
If I have two identical linux virtual machine images, will they generate identical random numbers?
A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically?
Or maybe someone could direct me to a helpful research ...
3
votes
1answer
101 views
What is the actual value of a certificate fingerprint?
In a digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
0
votes
1answer
60 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
3
votes
3answers
121 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
1
vote
1answer
66 views
Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?
If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data?
If the latter, then if someone had access ...
3
votes
3answers
121 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
Thanks!
2
votes
2answers
104 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
2
votes
2answers
65 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
0
votes
0answers
19 views
RSA Encryption? [migrated]
Let p and q be prime numbers, N the product of pq and e number relatively prime to (p-1)(q-1)
The way I understand RSA works is:
The public key of the receiver would be would be (e,N)
The sender ...
1
vote
3answers
81 views
TLS Renegotiation Indication Extension vulnerability
I am trying to understand the TLS Renegotiation Indication Extension from the RFC.
I can understand that it is related to the fact that the renegotiation is send under the encrypted stream but can not ...
6
votes
4answers
494 views
Why most people use 256 bit encryption instead of 128 bit?
Isn't 128 bit security enough for most practical applications?
1
vote
1answer
62 views
how do extended validation X.509 certs work?
https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
1
vote
2answers
121 views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
2
votes
1answer
44 views
Is SSL session based only? Is there a (formal) definition of an SSL connection?
In various docs on SSL there is a mention of connection.
But from the context I am not sure if this means the underlying TCP connection or the SSL connection.
I am thinking that there is no SSL ...
14
votes
4answers
772 views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
1
vote
1answer
87 views
What are the requirements for a random number generator to a be safe to use in cryptography?
When I look at most RNG's (random number generators), I see a disclaimer that looks similar to this:
Caution: Mersenne Twister is basically for Monte-Carlo simulations - it is not ...
2
votes
1answer
67 views
Convert RSA public key to the right format
I need to send a public key to my bank. I'm using CoreFTP which allows the generation of keys using RSA. It says that it generates "OpenSSH compatible certificates [sic]" when you press the generate ...
2
votes
1answer
46 views
Browsers and export regs. Is SGC still valid?
I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
0
votes
0answers
50 views
Where to find a compiled version of GPG.exe for Windows? [closed]
I've been looking through the GnuPG.org site, and many others to try and find a compiled version of GPG.exe for Windows.
I understand there is GPG4Win, however, I was looking for something a little ...
0
votes
1answer
79 views
Should I use Windows' Cryptographic Service Provider to generate RSA keys?
If I want to generate strong high quality RSA keys, is there any reason not to use Microsoft's built-in cryptography system? Or should I use something open source like OpenSSL or Bouncy Castle?
I'm ...
-2
votes
0answers
60 views
Is easy to generate AES key or RSA asymmetric for mobile phone [closed]
Can anyone help? Am new in Bouncy castle(BC). Can RSA key pair for mobile phone be generated from another source?
Thanks
0
votes
2answers
90 views
how to prevent file duplication/burning of cd/dvd
I have HTML and SWF files that i want to put on CD.
1. How can I protect the contents on CD or make it difficult for someone to burn or duplicate?
Thanks.
3
votes
3answers
181 views
Is there a crypto system which detects decryption somewhere between sender and receiver?
I was wondering if there exists (or if it could be created) a cryptographic system in which a message is encrypted and sent from A to B, and some nodes in the middle could intercept and decrypt the ...
3
votes
1answer
131 views
Encryption on the GPU, safer or not?
I was just wondering whether performing encryption on the GPU was safer than on the CPU, with regard to the difficulty of reading the encryption key from memory and/or various other hardware attacks.
...
1
vote
4answers
337 views
how safe is the 256 bit encryption used in bank transactions
Most of the banks use a 128 bit or 256 bit encryption. What does this mean? Does it mean that the keys used in ssl are 128 bit long or what?
If they are the ssl key lengths then 128 bit rsa keys are ...
-1
votes
1answer
51 views
dm-crypt and change ask for password text [closed]
I use dm-crypt how can I change ask for password text:
"No key available with this passphrase."
this is store in libcryptsetup.so.1 probably:
# grep "No key" * -R
Binary file ...
5
votes
4answers
228 views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
4
votes
3answers
265 views
What is the DUKPT Key Derivation Function?
I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
0
votes
3answers
68 views
Where can we learn more about recursive encryption schemes?
I've been wondering about recursed encryption. The idea I'm trying to convey here is an encryption scheme where a message is encypted, then somehow encrypted again, and again, etc.
The encryption ...
2
votes
3answers
166 views
Demonstration of how security through obscurity fails to work
I need to demonstrate that security through obscurity fails twice in the following scenario.
I've a secret KEY.
User A gets MessageX = SecretTransformation(KEY, SecretValue1);
User B gets MessageY ...
23
votes
4answers
4k views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
2
votes
1answer
80 views
How secure is TOTP key on phones?
Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
6
votes
4answers
342 views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
1
vote
2answers
122 views
Diffie Hellman - how large should the random number be?
When using the Diffie Hellman exchange with the second Oakley group 1024 bit Prime per RFC 2409 (*), how large should the random numbers generated by both sides be?
In RFC 2631 this is called the ...
3
votes
1answer
82 views
Recover file using Java RanNum Gen + Key
EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
3
votes
2answers
117 views
Taxonomy of Ciphers/MACs/Kex available in SSH?
SSH offers a large variety of algorithms for Ciphers, MACs and KexAlgorithms configuration options. Sometimes I need quick and light (my own internal network), and sometimes I want all the ...
0
votes
0answers
100 views
What is RSA Signature verification [closed]
What is the term RSA signature verification stands for ?
Here is my understanding:
The digital certificate file (X509 format) get downloaded from the connected-server, contains the public key of ...
1
vote
1answer
57 views
valid intermediate certs not in browser
Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
2
votes
2answers
66 views
Does the hash change the security of the Secure Remote Password protocol?
I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
4
votes
1answer
190 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
