Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
0answers
15 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
-4
votes
0answers
39 views

How to encrypt/decrypt with only encryption hardware?

Alice and Bob have agreed a symmetric key to be used for encrypting messages to be sent over an insecure (wrt a passive adversary) communication channel. Both of them have hardware devices for ...
6
votes
3answers
150 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where ...
2
votes
1answer
40 views

Is secret key for HMAC in form of UTF8 characters good enough?

There is a popular JWT library on nuget. I am analyzing an application that uses that library and it stores a secret key as a string. In the code of the library I see that it uses the MS HMACSHA256 ...
0
votes
1answer
36 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
4
votes
1answer
79 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
0
votes
0answers
20 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
1
vote
1answer
274 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
0
votes
1answer
35 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
0
votes
1answer
248 views

Bitwise cipher Cryptography

I'm doing an online cryptography course. There is a question in which it is given that the encrypted text for; OwBPAAQXAE9UC0FVBQxODgZSCUUMAQwCCApYRBJZBR0LDhoAGApPHQAUAQNZRAJPGwQbDQBDDREKQA== Is ...
-1
votes
2answers
27 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
-1
votes
2answers
96 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
67 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
3
votes
3answers
84 views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
0
votes
0answers
11 views

Is it possible to convert Key BLOB to any other format using CAPI [migrated]

We use Key Blobs to export keys in public key cryptography. Is there any other format to export key pair using crypto API's. So that the exported key storage type is compatible with other operating ...
0
votes
0answers
9 views

Encryption that could have multiple decryption key [migrated]

The title looks strange but it is to deal with this situation. The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have ...
0
votes
1answer
32 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
12
votes
2answers
319 views

How difficult it was to crack Navajo's language during WW2?

It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language ...
2
votes
1answer
102 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
0
votes
0answers
9 views

Security parameter p=O(n) [migrated]

In many homomorphic encryption scheme, a security parameter is given as p =O(n). How to use the big oh values for calculation? Is there any method to do that.
-2
votes
1answer
46 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
9
votes
3answers
289 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
5
votes
1answer
64 views

Encrypting individual files on OS X

I am about to go paperless, and I want to protect the documents that I scan. The use case is that I'll be scanning paper documents, encrypting each file, and storing them locally and on various backup ...
0
votes
2answers
46 views

Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible. Let X, A, B and C be arbitrary people from that group. Now X wants to encrypt a message ...
4
votes
1answer
81 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
3
votes
2answers
68 views

How can I create a secure random key for AES?

I need to generate a lot of shared keys for an AES method which uses in various condition, my concern is how can I generate unpredictable keys? I've had some research on Cryptographically secure ...
2
votes
1answer
48 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
-1
votes
1answer
43 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
5
votes
2answers
164 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
2
votes
1answer
108 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
-2
votes
2answers
132 views

How are people still copying and redistributing DRM-protected music

...when DRM-protected material is encrypted using the AES cipher, which there are currently no efficiently computable cracks for?
3
votes
1answer
75 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
0
votes
1answer
79 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
-2
votes
1answer
81 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
5
votes
1answer
73 views

How Can Malware Hide Using Cryptography

How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then ...
1
vote
0answers
26 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
5
votes
1answer
48 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
2
votes
1answer
81 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. ...
4
votes
1answer
82 views

Is keepass random password generator fully secure and trustworthy?

Am I safe using keepass for generating passwords? For example my accounts, am I safe using a keepass generated password? Could my future keepass master-keys be safely generated in keepass? What method ...
2
votes
2answers
89 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications ...
1
vote
0answers
44 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
1answer
77 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
70 views

Steganography concept - How to check my implementation? [closed]

I have written my own software to do Steganography. Basically, I am dividing the message (text) into bits and then hide them into pixels in jpg. After that I am saving the bitmap into .png (because ...
1
vote
2answers
51 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey ...
1
vote
2answers
53 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
3
votes
0answers
78 views

Is there a benefit in measuring randomness? How would it be done?

Is there any benefit in determining how random a given file, stream, signal is? I guess this would be useful to determine If something is (poorly) encrypted To verify the proper encryption of a ...
10
votes
4answers
1k views

Possible to read strength of encryption?

With the recent talks of governments trying to weaken encryption, I had a question about how they would implement it. For example, let's just say that the government banned anything above AES-128. I ...
5
votes
1answer
106 views

Resetting the Windows RNG

According to this research, Windows seems to produce the same sequence of random numbers indefinitely when a process is kicked off before a VM snapshot is taken. This is a huge issue obviously when ...
47
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
179 views

Crack 512-bit RSA encrypted messages without a private key?

I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have ...