Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
3
votes
1answer
106 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
6
votes
2answers
74 views
Backup schedule for Encryption Keys
How often should encryption keys be backed up?
Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.
Perhaps ...
2
votes
2answers
34 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
15
votes
2answers
316 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
4
votes
3answers
189 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
3
votes
1answer
102 views
Recognizing PGP-encrypted disks
I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS.
I am interested to know how an encrypted partition/disk/file with a particular ...
6
votes
1answer
117 views
Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?
Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words,
Bit manipulation instructions are useful for compressed database, hashing , large ...
-3
votes
0answers
92 views
Decrypt my cookie [closed]
Would anybody -with the right experience- point me to the encryption, encoding, hash this number: ah0nr6721epbph2tts2i0bttd2 is stored as -if it is at all. It's a PHP session cookie.
2
votes
0answers
53 views
Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? [migrated]
H(s,r)=d is a function that hashes the string s with a salt r, giving the result d.
Hashing functions are not injective, so there isn't a reverse function H'(d,r)=s.
Therefore to prove that d is a ...
2
votes
1answer
66 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
3
votes
1answer
82 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
1
vote
1answer
68 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
-1
votes
1answer
172 views
What is a man in the middle attack?
My university provided me with the following slide which is confusing me:
From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
64 views
Symmetric Key Cryptography vs Public Key Cryptography [duplicate]
I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-7
votes
1answer
61 views
Asymmetric encryption algorithms [closed]
What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
10
votes
2answers
187 views
What are the practical uses of large asymmetric keys?
The Windows CNG supports keys of varying sizes, e.g. RSA up to 16384 bits: http://msdn.microsoft.com/en-us/library/windows/desktop/bb204778(v=vs.85).aspx.
My understanding is that in crypto today we ...
3
votes
1answer
51 views
Clarification on Digital Certificates
I used the makecert tool to create:
self-signed certificate
client certificate
These are the commands I used:
makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
2
votes
1answer
61 views
Hash extension(padding) attack
I recently came across this website talking about sha1 padding attack.
http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/
After reading here are some of my doubts:
How ...
2
votes
1answer
62 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
3
votes
1answer
136 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
1
vote
1answer
87 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
0
votes
0answers
7 views
Why SecureRandomSpi or other SPI (Service Provider Interface) in java security are abstract not interface? [migrated]
SecureRandomSpi is Service Provider Interface. All the abstract methods in this class must be implemented by each service provider who wishes to supply the implementation of a cryptographically strong ...
3
votes
4answers
233 views
Is it possible to configure any of wifi protocols so that the network is undetectable?
I am wondering if it possible to configure my DD-WRT router so that the wifi network I am using is undetectable - impossible to tell if there is any network broadcasting even if there are clients ...
4
votes
1answer
88 views
Switching to new encryption method (without losing data?)
Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
4
votes
3answers
99 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
1answer
94 views
Cryptography Online Education
Do the security experts at IT Security have a preference between the two cryptography courses offered by Coursera (Stanford), "Cryptography I" and Udacity, "Applied Cryptography"?
I am seeking an ...
3
votes
1answer
69 views
3DES with fixed-encoded random key
I need an advice. I have a communication protocol using 3DES cipher.
Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server ...
4
votes
4answers
162 views
Why do you need message authentication in addition to encryption?
I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states:
Authenticated encryption is a form of encryption that, in
addition to providing confidentiality ...
5
votes
2answers
97 views
NTLMv2 resistance to bruteforcing
I have a question regarding NTLMv2 resistance to password bruteforcing.
I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
1
vote
2answers
215 views
Questions to hybrid encryption. RSA with AES
I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net)
byte[] aesKey = ...
2
votes
1answer
113 views
zero knowledge proof - where do we use it?
zero knowledge proof, where do we use it online? I thought we mostly use the RSA algorithm.
1
vote
1answer
52 views
ECDH and Forward Secrecy
I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, ...
1
vote
1answer
101 views
Symmetric or asymmetric encryption for JSON Web Token?
We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token.
There appear to be two options for ...
1
vote
2answers
137 views
How can i calculate the number of possible passwords?
I have found a flaw in a site where the password reset feature resets passwords in the following format
UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter
...
5
votes
3answers
274 views
Is there a length beyond which increasing password length provides no additional security?
Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security?
Since the hash will have a ...
1
vote
1answer
38 views
Parameters in output of password hashing function
A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format:
...
10
votes
2answers
986 views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
1
vote
1answer
128 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
3
votes
2answers
244 views
Does it make any difference of the order Hashing and Encrypting in terms of security?
I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing.
My question is would it make any difference if I first hash the raw data ...
1
vote
3answers
111 views
Cryptography key gathering tool
I am wondering if there exist a tools which can return the value of the one of the private key if the following are known:
1) Encryption Algorithm
2) Public key
3) Plain text
4) Cipher text
Or may be ...
3
votes
1answer
124 views
Why do PGP master keys only have a single subkey, and tie certification with signing by default?
After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
2
votes
2answers
108 views
Many-time pad on image data, how to proceed?
I have raw image data that is XOR-encrypted with a fixed-size one-time pad repeated over the length of the image. I know what the format of the image data container is so I can successfully retrieve ...
5
votes
1answer
93 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
3
votes
1answer
287 views
Will double encryption increase the security of cipher vs bruteforce?
Lets say, I have a function
encrypt(mes,key)
where :
mes = message
key = key
Length of key is 64bits.
Lets say, that only way to crack my cipher is brute force attack.
If I use
...
14
votes
8answers
613 views
Is advanced mathematics relevant to security beyond cryptography?
Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, ...
5
votes
3answers
118 views
What specific padding weakness does OAEP address in RSA?
It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks.
Can someone elaborate this in better detail? I'd specifically like to know the ...
