Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

1
vote
1answer
36 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
-1
votes
1answer
34 views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function ...
0
votes
1answer
31 views

Subject verification of certificates

Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?
0
votes
1answer
103 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
1
vote
1answer
28 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
2
votes
2answers
110 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
0
votes
0answers
45 views

Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

Alice wants to send an encrypted message to Bob, but she also wants to connect to Carol's server. Are there any dangers associated with using the same RSA key for both PGP and SSH (other than a lack ...
-1
votes
0answers
52 views

Password Encryption [closed]

I have retrieved the following encrypted password string. O\\?90\x1c$\\?a7\\?fa\x13\\?a0u\\?a8\\?c1\\?af_\\?de\r\\?41 I have changed the values obviously. But not the format. Could anyone help me ...
0
votes
0answers
11 views

Finding out key size used in ECDH algorithm in C#? [migrated]

I am a beginner when it comes to any EC algorithm, so please help me understand this basic question. While reviewing the C# code, how can we find out the key-size used in the ECDH implementation? or ...
0
votes
2answers
111 views

Untraceable Digital Cash?

I have read some articles regarding digital cash with untraceable(Here). Their protocol is provided below Withdrawal: Alice creates an electronic coin and blinds it. Alice sends the blinded ...
1
vote
1answer
20 views

How can i store encryption key into Microsoft provided Key container?

I'm working on an application in which user will enter encryption key via GUI and my app will fetch that encryption key. Now i need to store that received key into Microsoft key container. I got this ...
0
votes
0answers
21 views

Which stream ciphers are supported in am335x cryptographic accelerator?

I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I ...
7
votes
3answers
2k views

Google Chrome “Your connection to website is encrypted with obsolete cryptography”

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography ...
2
votes
0answers
25 views

Statistical saturation attack on block ciphers [migrated]

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is this What I really need is basic explanation of the ...
16
votes
4answers
3k views

Is it dangerous to publicly share ciphertext?

Alice wants to share a message with Bob, but Alice and Bob can never be in the same place at the same time. We can assume they both know each others public keys (or agreed on a shared key, if that ...
2
votes
3answers
101 views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
0
votes
1answer
81 views

How can I tell if my client has been infected with CryptoWall?

Today a client ran a file they believed to be something else, they said a black window appeared, so I checked the code to see what it ran in CMD, but can't quite work out what it's doing. I've just ...
0
votes
1answer
56 views

Can you recover the password from ZipCrypto encrypted ZIP file?

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily. Now the question is, can you also get at the password (assume this is a very long, very high ...
2
votes
1answer
143 views

Does OpenSSH use export ciphers?

With all of this talk of 'FREAK', no one has mentioned OpenSSH. It implements libraries from OpenSSL (until recently, anyway). Why aren't people talking about this? is there even a way to configure ...
7
votes
4answers
295 views

How to check randomness of random number generators?

Assume that I have a smart card that returns an 8 byte (for example) random value on reception of a command. The question is that: How I can check if this value is really random? (I don't have any ...
0
votes
0answers
15 views

Can AES IGE be parallelized? [migrated]

As far as I know in AES IGE each block depends on the previous one. In that case can it be parallelized. Is there some way to do it??
1
vote
1answer
80 views

How to keep a reasonable level of entropy in an encrypted file?

Encrypted (or random) data, by nature exhibit a high entropy value and non unencrypted data will exhibit a low entropy value. From an attacker point of view the precense of this high entropy value in ...
1
vote
1answer
38 views

ssl+symmetric with my own encryption algorithm? [closed]

I am a final year student currently doing my project, the title is "Mitigating man in the middle attacks using ssl+symmetric key algorithm". I would like to create my own encryption algorithm. I need ...
3
votes
2answers
309 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
1
vote
1answer
37 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
-1
votes
1answer
23 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
-1
votes
1answer
41 views

Do we need to same PGP version for decryption [closed]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
3
votes
1answer
70 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
2
votes
1answer
61 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
3
votes
1answer
96 views

Security of hybrid encryption scheme

I want to use a hybrid encryption scheme for file encryption. The scheme must use PKCS#1 v1.5 – which is vulerable to padding oracle attacks – because many smartcards (e.g. the OpenPGP Card) only ...
3
votes
1answer
224 views

SIM card - Cryptography

I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...). Is crypto used only for ...
3
votes
1answer
123 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
-2
votes
1answer
58 views

Tell type of encryption if given both input and output strings [closed]

I have the string Thisisatest that is encoded as MDQ4MGFhMzRhYTNkYjM1OGIzN2NkZTJhYjZiNjUzMjY= and I am trying to find out what encryption is used here. I think that the encoded string is base64 ...
0
votes
1answer
56 views

What is the security/copy protection model for streaming media services?

I realize this is a broad question, but maybe there is a simple answer From my understanding, Streaming media services such as Amazon instant video, Netflix, and others do all decryption client side. ...
1
vote
1answer
57 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
1
vote
2answers
59 views

Two-way encryption that can be nested?

In building a security system, I'm looking to prevent 'man-in-the-middle' attacks in a two-way encryption system, using the following setup: A sends B a message, encrypted with code 1 B sends it ...
7
votes
4answers
924 views

What happens when encrypting with private key? [duplicate]

I have a theoretical question. There is a public key-system. Person1 wants to privately send a message to person2. From my understanding, person1 is supposed to encrypt their message with public key. ...
1
vote
0answers
65 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
2
votes
1answer
47 views

What does a FIPS validation certificate cover? Just software version or OS and hardware too?

As I understand it, if you want to be FIPS-compliant you have to use FIPS-certified components. My question is how different can your use of the component by from what's on the component's validation ...
0
votes
2answers
106 views

Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way: This is a Caesar ...
0
votes
1answer
58 views

Default Encryption - A Panacea or Placebo

I wrote this on LinkedIn - Discrete Discretion My first question is: Is it accurate to say that default encryption is a placebo? Will default decryption only make end-users think they are secure ...
2
votes
2answers
76 views

How can I create my own public certificate using openssl?

I have a public key/private key pair i generated using two primes p and q. I now need to use openssl to sign and create the certificate. I heard req utility and wrote this from the man pages. openssl ...
1
vote
2answers
63 views

What type of encoding do .pem files use to store the key?

What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus? I can retrieve the modulus using the following: openssl rsa -in ...
2
votes
2answers
90 views

RSA and AES combination in offline situation

I need to securely request and receive data from a server. The client has the RSA public key, and the server has the RSA private key. So I am generating a random key for AES-128/CBC cipher and ...
3
votes
2answers
155 views

What is the point of AES key wrap (with JSON Web Encryption)?

I'm looking at JSON Web Encryption (JWE) and am left a bit confused about why you would use AES key wrapping. The document even talks about using matching key algorithm strengths: Algorithms of ...
14
votes
6answers
2k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
17
votes
1answer
451 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
4
votes
3answers
10k views

CryptoWall 3 - how to prevent and how to decrypt?

My father's computer is now infected with CryptoWall 3, according to the link below. http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall Is there a way to ...
12
votes
1answer
747 views

Relationship between RSA, Diffie-Hellman Key Exchange, PKI and X.509?

I am getting confused with RSA, Diffie-Hellman Key Exchange, PKI and X.509v3. I took a look of RSA's mathematics algorithm, it seems like a encryption algorithm, right? Generating public key and ...
0
votes
1answer
30 views

length of a session key in EC?

In elliptic curve cryptography what should be the length of session key? Is there a specific metric to choose one, or are they randomly generated? I was studying one paper about defence against a ...