Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
2answers
46 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
0
votes
2answers
58 views

Is there something similar to pseudorandom generators but in the opposite direction?

Pseudorandom generators (PRG) are functions that takes a random small input (called the Seed) and maps it into much larger output . However, the mapping process must be unpredictable in order for the ...
0
votes
2answers
61 views

How to generate a superkey to decrypt strings

I'm working on an application where users have a key or password generated by me that is used to encrypt a string. Each user has their personal key, and no user should be able to decrypt another ...
1
vote
1answer
80 views

How easy is it to crack this encryption algorithm? [on hold]

When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
0
votes
1answer
28 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
2
votes
1answer
49 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
2
votes
2answers
81 views

What problem does ECC seek to fix compared to RSA?

Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC ...
0
votes
1answer
22 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
-2
votes
1answer
79 views

good books for learning network and web security? [closed]

I am reading "Hacking The Art of Exploitation" book . i have read till chapter 2 programming but most of it has gone above my head . I want to learn basically cryptography , network security and web ...
0
votes
2answers
74 views

Cryptography protocol suitable for two-way radio communications

Specifically talking about walkie talkie radio networks. Suppose there is a group of up to 16 persons, each equipped with such a unit. Typically, one person will be talking with one another ...
0
votes
0answers
17 views

Mobile App Processing Debit Card Transactions

I am creating a mobile app for iPhone and Android and the respective API that will be exposed to support the operations. This operations will require the customer to type the PIN to complete the ...
0
votes
2answers
52 views

What is the collision likelihood of MD5 when non-numeric values are removed?

Start with a unique identifier String macAddress = "CC:3A:61:24:D6:96"; Hash the identifier via MD5 implementation String hash = md5(macAddress); //bd37f780e10244cf28810b969559ad5b Remove all ...
0
votes
1answer
26 views

–°ompromised client.p12 file in OpenVPN

I'm not clearly understand technologies behind OpenVPN, so I have a question about OpenVPN security: What if I have client.p12 (PKCS#12) file and this file was leaked (with export password) to some ...
2
votes
1answer
79 views

Properties of AES Encryption

First of all, I apologize if these questions can be answered using a web search, but I'm sort of a crypto noob and don't know what to search for. Given N AES encrypted messages (where the message ...
1
vote
1answer
30 views

What is the relationship between Suite B and FIPS 140-2?

What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria? From what I've read, it seems that OpenSSL's crypto library implements many ...
1
vote
2answers
238 views

What's the point of the nonce in CTR mode?

Does having a nonce in CTR mode actually improve security (vs. just using 1, 2, 3, etc. - basically a constant nonce of 0)? As far as I can tell, the best-case scenario security-wise is that the ...
5
votes
3answers
108 views

AES256, repeated IVs and mostly-costant payload: how ok/bad is that?

I recently came across an application that more or less does this: starts from a (supposedly unknown to others) key generates a random IV encrypts some smallish (~ 160 bytes) payload with the key ...
3
votes
1answer
92 views

When to use HMAC alongside AES?

One of my clients wants to provide an URL to each of his customers to register in a system. This URL would contain a query string parameter with some data (e.g. code, email and name) from his clients ...
0
votes
0answers
37 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
0
votes
2answers
147 views

Reversible Hash Function?

Is there any reversible hash function? The hash function like SHA and MD5 are not reversible. I would like to know if there exist some reversible hash functions?
3
votes
1answer
49 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
1
vote
1answer
59 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
0
votes
0answers
20 views

How does OTR's authentication using “Question and answer” protect against MiTM?

I've read that the answer has something to do Socialist Millionaire, but I still don't understand how can the user be protected against malicious Man In The Middle, which would capture the question ...
0
votes
2answers
51 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
0
votes
1answer
34 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
2
votes
1answer
87 views

Bastion host that allows jailed users to SSH but protects private key

Basically, I'm trying to let the user use a private key without having read access to it. Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, ...
2
votes
1answer
84 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
1
vote
0answers
35 views

Generate a public key certificate signed by CA with OpenSSL [migrated]

I am working on a webservice that requires a signature in the sent and received messages. After sending a certificate request to the entity that will consume the webservice, they sent me (in addition ...
0
votes
1answer
97 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
56 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
1answer
58 views

Securing a Shuffle Algorithm

After reading about writing a secure shuffle algorithm, I realized that my module that generates a password is only as strong as my PRNG, which in this case is Math.random(). I'm confused as to how to ...
1
vote
3answers
93 views

When do governments allow export of cryptography software?

I see this notice in the TextSecure README: The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as Export Commodity Control Number (ECCN) ...
5
votes
1answer
103 views

How are chosen plaintext attacks against ECB implemented in the real world?

Reading up on attacks against AES i have seen countless examples of why ECB is bad, and the logic behind it i can understand, but i can't get my head around how these attacks actually work in the real ...
2
votes
1answer
145 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
0
votes
2answers
82 views

Some questions about crypto

How to determine what type of encoding/encryption has been used? This link discusses in the first answer a "128 bit" value. How do you know that it is 128-bit and what is a 128bit value? If I md5sum ...
1
vote
1answer
76 views

What keeps the private key safe if an attacker has both clear and encrypted copies of a message and the public key?

Let's say someone obtained a message in both clear text and in its encrypted copy with asymmetric cryptography, like RSA-2048. He also has the public keys. Is the private key still undiscoverable? ...
1
vote
1answer
99 views

What are the enhancements of SHA1 compared to MD5?

I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size. Also, I think md5 is faster than ...
2
votes
1answer
101 views

What cryptosystem makes the encrypted text look like random noise?

Suppose one wants to setup a cryptographic protocol in which 2 parties communicate using an encryption scheme that produces encrypted messages indistinguishable from random data (the desired property) ...
1
vote
2answers
86 views

Expiring AES Key

Is there any way to make an "expiring" AES key? Here's scenario to give a better picture: Say Bob has some data which he would like to share with Alice. Alice has a public and private key, let's say ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
1
vote
2answers
137 views

Is cryptography possible without volatile memory?

AFAIK, our current disk encryption methods (dm-crypt) preserve the key (as well as decrypted data) in RAM while the computer is running with an implicit assumption that the memory is volatile and key ...
1
vote
2answers
123 views

What is DVNC and how does it work?

As stated on their website: DVNC is not encryption but is a new branch of cryptography and information science. DVNC employs a new paradigm in secret keeping to keep your data secured. I ...
-1
votes
2answers
135 views

If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?

I'm going to preface this by saying I have absolutely no clue when it comes to cryptography, but I'm posting this question because I'm very interested and I have no doubt there are some smart people ...
4
votes
2answers
148 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
1
vote
2answers
83 views

RSA-Based Signature Algorithms

From Beginning Cryptography with Java - chapter 4, digital signatures: Signatures are created using the RSA algorithm by applying the RSA algorithm using the private key and then distributing ...
1
vote
1answer
152 views

Why do you need a 4096-bit DSA Key when AES is only 256-bits?

This is something which I have been wondering and trying to find an answer for, but yet to come even remotely to one. Why do you need a 4096-bit DSA/El-Gamal key when AES uses only 256-bit keys?
5
votes
1answer
620 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
0
votes
1answer
92 views

Understanding cryptography practically [closed]

So I am interested in computer security, cryptography and security protocols. Thing is, everything I read is about theoretical usage of protocols, but how do those things work in real world? Is there ...
0
votes
1answer
63 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
0
votes
3answers
98 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...