Tagged Questions

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
2answers
70 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
0
votes
1answer
87 views

Why is not safe to use the same public key in RSA?

In the RSA context, why is not safe to use the same n (public key)for different people?
0
votes
0answers
84 views

How to decrypt crypt7 files from whatsapp [on hold]

I copied my entire Whatsapp folder from my Android phone onto my computer but I can't figure out how to decrypt the msgstore.db.crypt7 file to just msgstore.db
0
votes
2answers
29 views

encryption using two keys

The use case is analogous to accessing a safe box in a bank. There is a per-user key, unique for each user, either generated by the system or hashed from the user's password. And there is a ...
2
votes
2answers
76 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
0
votes
0answers
32 views

Is there a good list of all the parts of the Security Chain? [closed]

I was thinking there must be a concise description, at a high level, of all necessary & sufficient conditions. Like: Strong Crypto, Key Management, Key Cycling, Physical Access, ...
3
votes
1answer
64 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
0
votes
1answer
85 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
0
votes
0answers
17 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
18
votes
3answers
1k views

What is the difference between “key length” and “bit strength”?

On occasion, I hear the terms "key length" and "bit strength" used interchangeably. Are these the same things? Or are they different?
1
vote
2answers
40 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
-1
votes
1answer
41 views

Permutation based file secure

I have a thought. 1. Take a file. 2. Read number of bytes. If its less than 2048, padd it till 2048 3. Read each byte. And create a single file which contains the particular byte. Give a random name ...
0
votes
1answer
61 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
7
votes
1answer
48 views

Unlock codes for a mobile app

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only ...
1
vote
1answer
67 views

Hardware Implementation of Encryption Algorithm

In the abstract of the AES-GCM RFC, the following passage is prominently included: [AES-GCM] can be efficiently implemented in hardware for speeds of 10 gigabits per second and above... Is the ...
8
votes
4answers
726 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
5
votes
2answers
589 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
4
votes
2answers
127 views

Encrypt with private and decrypt with public

Above picture is captured from iOS Security overview at page 25. The path encrypt with public and decrypt with private makes sense. But the other path, encrypt with private and decrypt with public ...
2
votes
2answers
72 views

Difference between Second Pre-image Resistance and Collision Resistance in Cryptographic Hash Functions

I am studying the subject from these notes. However it is not clear what is the difference between "Second Pre-image Resistance" and "Collision Resistance" properties of Cryptographic Hash Functions. ...
28
votes
2answers
3k views

What actually happens in “low voltage fault attacks”

I understand they are an attack on crypto algorithms as implemented on various processors, but how do they work? The online papers are too complex for me to understand.
6
votes
1answer
131 views

Two takes on PHP two way encryption - which one is preferable?

I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions... 1: The first one is derived from the official ...
1
vote
1answer
63 views

Can a known MD5 hash limit the search space for SHA1 collisions?

For a course in game theory, we are dealing with BitTorrent and alternative strategies (roughly alternative clients) we can employ to maximize our download speed. One strategy is to over-report the ...
1
vote
0answers
11 views

FEAL-4 Wrong outputs of Round Functions [migrated]

On page 2 of this article, there is example of FEAL-4. At round 2, the input to F (Round Function) is 0x80800000. As F accepts only 4 bytes I divide the input by 2 so that (As I assume the result ...
3
votes
2answers
65 views

Generating encryption key using location data and other hardware data

I'm trying to find information on encryption without key storage, I plan to generate the key using location data, and hardware addresses, so the key is never stored, instead it is generated if the ...
0
votes
0answers
149 views

John the Ripper - Calculating brute force time to crack password

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 ...
1
vote
0answers
44 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? For example: I can imagine a system where a recovery key is generated, split using secret ...
2
votes
1answer
50 views

Figure out if “correct” encryption algorithm was used

Given a database like CryptDB, is it possible to determine whether the data is actually encrypted with the correct (specified) onion? I'll elaborate a bit: CryptDB uses onions (chaining) of ...
0
votes
1answer
34 views

OpenSSL -nopad with ECB mode

I was just trying to check if OpenSSL does use PCSK5 as documentation states when I got the following problem. I first encrypted a plaintext and encrypted it using DES-ECB. I was expecting to see ...
2
votes
2answers
46 views

Expand key to size of plaintext

I'm taking a cryptology course, and one thing that popped up as an idea was the following: Can't one take a "master" key, and generate a key that is as big as the plaintext, to encrypt the plaintext ...
0
votes
1answer
102 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
1
vote
2answers
73 views

How is a cypher algorithm verified?

I've always thought about how the symmetric cyphers are verified. Let say I would invent a new cypher. (actually I don't :-)) How should I rationalize its security to the public? As far as I saw ...
1
vote
1answer
33 views

How to store derby database encryption key in HSM?

The Derby Database supports encryption with a key or password. Traditionally this key is stored in the file systems, now I am looking to store and protect this key in the HSM instead, but I couldn't ...
0
votes
1answer
46 views

Secure shuffles and the rand() function

I'm trying to understand one aspect of a secure shuffle using Fisher-Yates. For reference, here is Fisher-Yates to shuffle an array x of n elements (numbered from 0 to n-1) (from Securing a Shuffle ...
1
vote
1answer
57 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
0
votes
2answers
117 views

Why does the finance industry uses 2TDEA instead of 3TDEA?

Why does the finance industry uses 2TDEA instead of 3TDEA; is there any historical reason or technical limitations like the support by HSMs used in the industry? The paper referred to here says ...
1
vote
1answer
110 views

Efficacy of self-made ransomware protection

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known ...
7
votes
4answers
985 views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
0
votes
1answer
79 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
0
votes
1answer
91 views

Key Exchange using RSA

I'm trying to do key exchange using the following scheme. Server generates an RSA-2048 key pair and sends the public part to the client Client generates an RSA-592 key pair (I have to use RSA-592 ...
-1
votes
3answers
58 views

Full control on cryptography vs relying on external certificate [closed]

I have a question with regards to having full control on the cryptography which you will be using for your own application vs relying on external entities such as certification authorities? What are ...
0
votes
1answer
105 views

rolling code & keyless entry system [closed]

The security industry typically uses rolling code algorithms to authenticate sender & receivers in keyless entry systems, which is called RKE (ex: KeeLoq). In key-less smart key car system, The ...
3
votes
2answers
81 views

Link Layer authenticated encryption vs authentication

Many security articles discuss about adding an extra layer of security at the link layer by either authenticating the data at the link layer authenticating and encrypting it. If we have ...
-1
votes
3answers
111 views

Is information security based entirely on mathematics [closed]

I started to show interest in information security few months ago, the more I read the more I think it's all about mathematics not information techonolgy. I mean the whole thing is based on encryption ...
1
vote
2answers
78 views

Real-world applications of Differential Privacy?

Differentially private techniques guarantee privacy while often permitting accurate answers ...this is something I have been reading up on lately as a means of preserving user ...
15
votes
4answers
2k views

Why should I sign data that's already encrypted? [duplicate]

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it? Doesn't the PKI encryption inherently provide ...
0
votes
1answer
40 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
3
votes
3answers
172 views

Is there any security gain / risk by adding additional padding (beyond what is required) when using AES-256 to encrypt very short strings?

I would like to encrypt some authentication tokens using AES 256 (not tied to this algorithm but it seems to be a reasonable choice). These messages are usually very short at 128-256 bits. I'm ...
0
votes
1answer
262 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
0
votes
2answers
86 views

Encrypting using the private key in Identity-Based Cryptography

In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
1
vote
2answers
89 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...