Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
3answers
53 views

Crypt-analysis methods for breaking or finding weakness in an encryption algorithm?

How cryptanalysts work on an algorithm related to diffusion/confusion factors in order to find a weaknesses in an algorithm, for example how cryptanalysts could find weakness on DES? is there methods ...
0
votes
4answers
66 views

How does PKI work for the client side?

As I send this question as a request to yahoo's server, the information in the request will be encrypted with yahoo's public key (which is available for everyone). Then the information will arrive at ...
1
vote
5answers
123 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
0
votes
1answer
13 views

How to get my GNUPG Elgamal private key exponent?

I have tried googling around. The closest solution I get is: private.key contains the private key file. $pgpdump -i private.key But this only gives me the following: ElGamal p ElGamal g ElGamal y ...
0
votes
2answers
78 views

Is it a secure encoder and hasher?

I want to ask if my code secure or not. if this is not secure please tell me the reason. This code is mixed of Rjindael-256, base64_encode and SHA-512. function xencoder($input,$key) { $salt = ...
-2
votes
0answers
62 views

Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm? [migrated]

NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A: Hash_DRBG (based on hash functions) ...
4
votes
2answers
131 views

How does a Tor exit node know the public key of the client?

When the Tor exit node executes the client's request and receives a response from the server, it must create an onion cell that can be reversely decrypted along a circuit through the Tor network. ...
0
votes
1answer
80 views

Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm?

For example: a 10 MB file will be sliced to 10 pieces (each 1 MB) and then dispersed between network nodes. Each node will encrypt it with its own key and different algorithm (AES, TwoFish, Blowfish, ...
2
votes
2answers
115 views

How can an attacker identify the encryption method with only ciphertext?

Assume that attacker only could obtain ciphertext, but knows that method is symmetric. Is there a way to find which algorithm was used for the encrytion? And in general, if attacker knows the ...
6
votes
1answer
457 views

can multiple encryption of data with multiple keys increase the security?

I mean: does encrypting data multiple times have an effect on diffusion and confusion? Does it increase security, or does it have no effect? Is it useless? Does it make it harder to break the secret, ...
1
vote
1answer
37 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
5
votes
1answer
85 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
17
votes
5answers
820 views

How can I explain “zero knowledge proof” to an end user?

A ZKP allows proof of knowing the answer to a secret, without actually disclosing what that answer is. Is there any analogy that can help people put this concept into everyday practice? A "lie to ...
1
vote
2answers
59 views

Sharing a common public and private SSH keys for a cluster of machines

I guess this is way to settle an internal debate I am having with myself. In my provisioning process, I am wanting to share a common public and private ssh keys for each machine in a clusters, ...
2
votes
0answers
90 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
1
vote
1answer
31 views

Is it possible to convert a gpg key to a different encryption algorithm [duplicate]

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
22
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
1
vote
2answers
71 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
4
votes
1answer
40 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
5
votes
1answer
67 views

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...
2
votes
1answer
83 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
2
votes
0answers
39 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
4
votes
2answers
87 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...
2
votes
1answer
66 views

Hashing algorithm for cryptsetup

I will encrypt my SSD using cryptsetup and I would like to know which hashing algprithm to use. First of all, cryptsetup benchmark: PBKDF2-sha256 262144 iterations per second PBKDF2-sha512 ...
2
votes
0answers
26 views

Reference Implementation for Shoup's ECIES?

ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some ...
23
votes
2answers
2k views

What is the purpose of frequently rotating TLS certificates without changing underlying keys?

I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
0
votes
1answer
28 views

Block size of CTR, CFB and OFB mode of AES in openssl

I am using openssl library. In all documents and webpages it is written that the block size is 128 bites(common for all AES modes). But what I observed in openssl is, for CTR, CFB and OFB modes the ...
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
1
vote
2answers
79 views

Is `arc4random` secure enough?

I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
3
votes
2answers
2k views

Chrome showing cryptography as 'obsolete'

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
0
votes
1answer
44 views

Which parameters can I use to analyse my cipher? [closed]

I have made a new methodology for a symmetric key cryptography in which I have used matrix operations, a boolean function and ASCII conversion. Please suggest me the possible parameters to judge my ...
2
votes
0answers
51 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
3
votes
2answers
118 views

How secure is MD5 for TLS message authentiaction?

I was recently viewing a website and saw its certificate info as follows: Given that MD5 is badly broken and not recommended for hashing, how good is it for use in TLS? And why?
0
votes
2answers
219 views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...
0
votes
1answer
101 views

RSA key sizes v/s public key sizes

I am new to cryptography. I have an api provided by a bank. The banks says that they are using RSA algorithm with 2048 bits. We used this api first to get the public key. Here is the sample public ...
0
votes
0answers
4 views

Crack linear congruential generator knowing every other word in sequence [migrated]

I need to crack one of the example of linear congruential generator. I have Xn+1 = (A * Xn + B) mod m and i know every other word in output sequence: ..., 3158, ..., 1888, ..., 1285, ..., 1744, ...
-4
votes
1answer
40 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...
5
votes
2answers
446 views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
2
votes
1answer
72 views

difference between public key and host key and security of host key

In SSH, what is the difference between host key and public key. Public key I believe that is part of private/public key pair, so, that anything sent by server(encrypted using private) can be ...
2
votes
2answers
288 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, such as voting, bitcoin payment, or other specific-purpose usage, and I want to make ...
2
votes
1answer
76 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
-1
votes
1answer
84 views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function ...
2
votes
1answer
45 views

Subject verification of certificates

Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?
0
votes
1answer
127 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
1
vote
1answer
38 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
134 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
0
votes
1answer
89 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
0
votes
2answers
180 views

Untraceable Digital Cash?

I have read some articles regarding digital cash that is untraceable (Here). Their protocol is provided below Withdrawal: Alice creates an electronic coin and blinds it. Alice sends the ...
1
vote
1answer
27 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
0
votes
1answer
34 views

Which stream ciphers are supported in am335x cryptographic accelerator?

I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I ...