Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

14
votes
5answers
4k views

Never spell a word the same way twice?

A long time ago I was reading about Renaissance-era ciphers and I remembered this quote: David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous ...
-2
votes
0answers
48 views

Crypted Virus | Extension spoofing [on hold]

We all know what a virus is. We all know what an anti-virus is. Most of us know what a crypted virus is. I am referring to the encryption of a virus which is used solely for bypassing anti-virus ...
0
votes
1answer
24 views

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ? When using smartcard, I can understand that ...
-2
votes
2answers
64 views

Will cyber security be around forever? [on hold]

As time goes on, won't computers be able to automatically test for vulnerabilities to the point where they will not be prevalent any more? What I'm essentially asking is will information security be ...
1
vote
0answers
34 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
3
votes
0answers
28 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit? [migrated]

In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ...
0
votes
1answer
20 views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
0
votes
0answers
15 views

JCE Unlimited Strength Jurisdiction Policy Files 8 [on hold]

What I know is that, this jar file is needed regarding some issue with the encryption key while encryption or decryption. Can some one tell what are the countries where we can't use this jar file? ...
0
votes
2answers
109 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
-2
votes
0answers
32 views

Assignment on two factor key authentication in cloud system [closed]

I am doing a assignment on two factor key authentication in cloud system. but I could not find any white papers related to this. Its grateful if you can provide some notes or sources related to this ...
-1
votes
0answers
25 views

HSM: creating new key using NCryptoki [closed]

I'm working with the NCryptoki dll (http://www.ncryptoki.com/) I'm new to this dll and I'm trying to do some stuff. Now I'm trying to create a new DES CBC key. I have write this, but it is giving me ...
0
votes
0answers
28 views

Is it possible to perform one-way OTR MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
2
votes
1answer
58 views

Encrypting USB traffic: Is RSA necessary for AES session key exchange when using pre-installed secret keys?

I need a solution to encrypt USB communication between device A and device B. I was thinking about configuring each device with a secret RSA-2048 key, which would be used to exchange an AES-256 ...
1
vote
1answer
46 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
-1
votes
1answer
52 views

Is it really worth to spend time on Telegram Crypto Contest? [closed]

Telegram is running this crypto contents. But what I heard from some people on the web is that they designed the contest in such a way that they made it practically impossible to crack. Is it really ...
0
votes
1answer
44 views

Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?

Is it possible to make a more secure random number generator (e.g. for cryptologic purposes) by combining two or more less secure random number generator algorithms using XOR? Here is an example of ...
0
votes
0answers
22 views

How to find the factors of the modulus? [migrated]

In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
3
votes
1answer
79 views

Is it considered woth it to replace OpenSSH's moduli file?

Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with. Taking the logic a step further, is there any concern with the ...
2
votes
1answer
31 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
1
vote
1answer
26 views

PBKDF2 strong salt

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So ...
0
votes
0answers
31 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
0
votes
0answers
6 views

Sophie Germain primes and safe primes [migrated]

I am trying to find a list or table of !!! safe primes !!! number i.e. the one that are based on the Sophie Germain primes i.e. N = 2p + 1 where p is also prime All i found till now is the following ...
0
votes
1answer
72 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
2answers
56 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
0
votes
3answers
79 views

Constant time compares when array sizes are not equal?

What is the preferred or recommended way to pursue contestant time compares when array lengths are not equal? Should we exit as early as possible? Something like: if (array1.size() != array2.size()) ...
6
votes
3answers
202 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
9
votes
3answers
688 views

Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
2
votes
1answer
94 views

Arduino to Android secure bluetooth connection

I'm using an Arduino Uno and a nRF8001 board from Adafruit to connect to an Android phone over bluetooth. I will be using it to lock and unlock a lock and I need to make sure only verified devices are ...
1
vote
3answers
111 views

Would this generated CSRF token be considered cryptographically strong?

I am working on enhancing the security of an existing web application which currently has not implemented the use of anti-CSRF tokens, so it is up to me to generate one, add the hidden fields and ...
1
vote
0answers
141 views

Is Tox really secure? [closed]

There is a new Skype-killer application called Tox. They said that it's open source and that it protects its users against governments and other adversaries that try to collect your information. But ...
2
votes
2answers
93 views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
8
votes
3answers
1k views

Does the entire AES encrypted dataset have to be present to be 'cracked'?

I am implementing an AES 256 algorithm on credit cards and I am wondering if I would be strengthening or weakening the encrypted dataset if I split the dataset and persisted it in two locations. I ...
9
votes
2answers
138 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
41
votes
3answers
4k views

Is Git crowdsourcing cryptographic attacks?

A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed ...
0
votes
0answers
44 views

Suggestion of encrypt method for short fixed size result

I'm searching for a encrypt method that receives an int variable and outputs exactly 11 hexadecimal digits. I'm starting on a existing application, that already has a database of more than 130.000 ...
0
votes
1answer
58 views

Integrity-Based Execution

Intrusion Detection Systems (IDS) rely on binary signatures or known-bad-behavior of malware in order to detect threats. It has become very clear that this approach has limited success due to the fact ...
9
votes
4answers
4k views

Is Changing a File Type and Name an Effective Security Solution?

Is renaming folders & files and changing file types an effective solution for file security of a PC? I am an application programmer and have an extensive background in it. I have written a ...
1
vote
1answer
69 views

Calculating D-Wave's integer factorization capabilties

D-Wave has teased the ability to perform integer factorization previously, but if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization ...
2
votes
2answers
85 views

Why is GPG encrypted message size not proportional to number of recipients & file size?

I have noticed that when I am using GnuPG to encrypt a file for multiple recipients, the size of the encrypted message does not seem to be directly proportional to the number of recipients. For ...
7
votes
1answer
501 views

Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?

This is technically not even an attack. We have all the resources at hand, except for the original plain-text. We have the cipher-text (to be converted back to plain-text), as well as the key. The ...
4
votes
2answers
304 views

Including and storing the order of character entry in a password as an enhanced security measure

I'm sure I will be quickly corrected if this is a stupid idea, or if it has already been tried. My question is: has this idea been tried before? If not, are there good reasons it would not work, or ...
1
vote
0answers
50 views

Public keys Quality

Is there any way to test the quality of generated keys from a public key cryptosystem? I've read about the common RSA attacks, but attacking the algorithm may not mean checking if the generated keys ...
2
votes
3answers
144 views

Are there any flaws in this two way cryptographic function?

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works. Split the message into an array of 32-bit (or something ...
2
votes
2answers
106 views

how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet [closed]

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to ...
0
votes
3answers
205 views

How strong is a simple XOR encryption with random IV?

I'd like to implement some kind of simple (yet as strong as possible) encryption for my client-server application network traffic. Data to be encrypted can be both textual, and binary. Now I'm ...
0
votes
1answer
72 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
-1
votes
1answer
48 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
1
vote
1answer
111 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
0
votes
1answer
60 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
1
vote
1answer
179 views

How can you check if a private key and certificate match in OpenSSL with ECDSA?

I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs. With RSA keys, the ...