Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
1answer
11 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
4
votes
1answer
76 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
0
votes
0answers
17 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
1
vote
1answer
266 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
0
votes
1answer
33 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
0
votes
1answer
248 views

Bitwise cipher Cryptography

I'm doing an online cryptography course. There is a question in which it is given that the encrypted text for; OwBPAAQXAE9UC0FVBQxODgZSCUUMAQwCCApYRBJZBR0LDhoAGApPHQAUAQNZRAJPGwQbDQBDDREKQA== Is ...
-1
votes
2answers
27 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
-1
votes
2answers
93 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
67 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
3
votes
3answers
82 views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
0
votes
0answers
11 views

Is it possible to convert Key BLOB to any other format using CAPI [migrated]

We use Key Blobs to export keys in public key cryptography. Is there any other format to export key pair using crypto API's. So that the exported key storage type is compatible with other operating ...
0
votes
0answers
9 views

Encryption that could have multiple decryption key [migrated]

The title looks strange but it is to deal with this situation. The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have ...
0
votes
1answer
32 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
12
votes
2answers
319 views

How difficult it was to crack Navajo's language during WW2?

It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language ...
1
vote
1answer
102 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
0
votes
0answers
9 views

Security parameter p=O(n) [migrated]

In many homomorphic encryption scheme, a security parameter is given as p =O(n). How to use the big oh values for calculation? Is there any method to do that.
-2
votes
1answer
45 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
9
votes
3answers
289 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
5
votes
1answer
62 views

Encrypting individual files on OS X

I am about to go paperless, and I want to protect the documents that I scan. The use case is that I'll be scanning paper documents, encrypting each file, and storing them locally and on various backup ...
0
votes
2answers
46 views

Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible. Let X, A, B and C be arbitrary people from that group. Now X wants to encrypt a message ...
4
votes
1answer
80 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
3
votes
2answers
67 views

How can I create a secure random key for AES?

I need to generate a lot of shared keys for an AES method which uses in various condition, my concern is how can I generate unpredictable keys? I've had some research on Cryptographically secure ...
2
votes
1answer
48 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
-1
votes
1answer
43 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
5
votes
2answers
163 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
2
votes
1answer
107 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
-2
votes
2answers
132 views

How are people still copying and redistributing DRM-protected music

...when DRM-protected material is encrypted using the AES cipher, which there are currently no efficiently computable cracks for?
3
votes
1answer
75 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
0
votes
1answer
77 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
-2
votes
1answer
81 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
5
votes
1answer
73 views

How Can Malware Hide Using Cryptography

How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then ...
1
vote
0answers
26 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
5
votes
1answer
48 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
2
votes
1answer
81 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
4
votes
1answer
79 views

Is keepass random password generator fully secure and trustworthy?

Am I safe using keepass for generating passwords? For example my accounts, am I safe using a keepass generated password? Could my future keepass master-keys be safely generated in keepass? What method ...
2
votes
2answers
85 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications ...
1
vote
0answers
44 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
1answer
74 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
69 views

Steganography concept - How to check my implementation? [closed]

I have written my own software to do Steganography. Basically, I am dividing the message (text) into bits and then hide them into pixels in jpg. After that I am saving the bitmap into .png (because ...
1
vote
2answers
50 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey ...
1
vote
2answers
53 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
3
votes
0answers
78 views

Is there a benefit in measuring randomness? How would it be done?

Is there any benefit in determining how random a given file, stream, signal is? I guess this would be useful to determine If something is (poorly) encrypted To verify the proper encryption of a ...
10
votes
4answers
1k views

Possible to read strength of encryption?

With the recent talks of governments trying to weaken encryption, I had a question about how they would implement it. For example, let's just say that the government banned anything above AES-128. I ...
5
votes
1answer
106 views

Resetting the Windows RNG

According to this research, Windows seems to produce the same sequence of random numbers indefinitely when a process is kicked off before a VM snapshot is taken. This is a huge issue obviously when ...
47
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
178 views

Crack 512-bit RSA encrypted messages without a private key?

I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have ...
3
votes
2answers
127 views

In Ephemeral Diffie Hellman Key Exchange - what is actually ephemeral?

Just starting to learn about Diffie-Hellman, and it seems simple enough, but I am struggling to find any resources that explain in an Ephemeral Diffie Hellman Key Exchange, what it is that is actually ...
1
vote
2answers
113 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
1
vote
0answers
36 views

Is there a point in cascade encryption? [duplicate]

I was reading the other day about some programs (ex: DiskCryptor), and with my limited knowledge of cryptography.. I started wondering about cascading encryptions (ex: AES-Twofish-Blowfish). Assuming ...
-1
votes
2answers
96 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...