Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
0answers
6 views

qkd - Does BB84 rely on a prearranged code? [migrated]

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically I was reading about quantum cryptography and came across BB84. The protocol ...
2
votes
0answers
134 views

What is the state of cryptographic obfuscation in 2015? [migrated]

Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a ...
5
votes
2answers
209 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
1
vote
0answers
22 views

Chosen plain text and chose ciphertext definitions clarification [migrated]

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker ...
2
votes
2answers
69 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
-1
votes
0answers
17 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
4
votes
1answer
74 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
1
vote
0answers
24 views

At what point is information encrypted when communicating from a C# program over HTTPS? [closed]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
31
votes
4answers
5k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
0
votes
0answers
28 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
1
vote
2answers
74 views

Building an anonymous network

Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with ...
0
votes
0answers
29 views

breaking down RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

So Java has a mode called RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING. What does that even mean? RFC3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, section ...
-1
votes
1answer
67 views

Why not create your own encryption? [duplicate]

I am wondering if AES-128 and the likes were once broken and if they were broken because people knew they were trying to break AES then why don't we create our own personal algorithm to encrypt the ...
0
votes
0answers
38 views

Why isn't a table used to solve the large number factoring problem? [migrated]

Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since ...
0
votes
0answers
28 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
1
vote
0answers
161 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
2
votes
0answers
35 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
0
votes
1answer
120 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
1
vote
3answers
45 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
1
vote
0answers
68 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
4
votes
1answer
64 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
2
votes
2answers
435 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
5
votes
2answers
112 views

Is RSA useless when my app is fully decompiled?

I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#. After I compiled whole game into .apk, I ...
4
votes
3answers
84 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
3
votes
1answer
83 views

GnuPG - Problems with large RSA keys

I have read that GnuPG limits the size of RSA keys to 4096-bits because this could lead to problems with running out of secure memory. But in which operation is this the case? Generating the keys? ...
1
vote
1answer
118 views

What is the most secure way to digitally communicate between the U.S. and China?

What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)? Updated: Here's some additional info: The ...
1
vote
1answer
117 views

Secure Client-Initiated Renegotiation - DoS DANGER

I tested my server against cryptographic attacks and I have a few major and minor issues. However I would like to know how can I mitigate and protect against such vulnerability warning: Secure ...
2
votes
0answers
69 views

A fledgling idea: Relational Encryption [closed]

I've been spending my spare time coming up with the basis for an encryption algorithm. I am completely unfamiliar with computer programming, but my time as a Network Technician left me incredibly ...
-3
votes
5answers
75 views

Asymmetric encryption: Is it possible to share private key and hide public key?

I know that normally it's the public key to be shared and the private key to be kept secret (hence the names) in asymmetric encryption. I have a special case that I want to encrypt some files and let ...
0
votes
0answers
71 views

How would an improved “read receipt” work as an email, Facebook post, or webpage?

I'm exploring various ways to implement cryptographic read receipts, that would be used to tell the content producer that the content was viewed. In addition to feedback reporting, a response might ...
1
vote
1answer
73 views

Am I encrypting and storing an array of user-details correctly?

I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have ...
1
vote
1answer
82 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
0
votes
1answer
113 views

Can this text be figured out?

It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised. I wonder if in this scenario is it ...
0
votes
0answers
37 views

Are there any paper/human strong crypto systems? [migrated]

Are there any paper/human executed crypto systems that have reasonable strength? I am aware of a few candidates so far Solitare from Cryptonomicon https://en.wikipedia.org/wiki/Solitaire_(cipher) ...
2
votes
2answers
75 views

Checksum Calculation for Source Code tar balls downloads

Http sites like OpenSSL provide checksum for each source code tarball available for download HTTPS sites like GitHub usually do not provide checksum with 'download zip' option. Some sites although ...
1
vote
1answer
51 views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
2
votes
2answers
85 views

ECC and RSA 10K stronger claim

There are a lot of websites where it is claimed something akin to this but no explanation on the basis. "ECC key size of 256 bits is equivalent to a 3072-bit RSA key and 10,000 times stronger than a ...
5
votes
2answers
418 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
4
votes
2answers
70 views

Where in a TLS connection can I get the signature of the content sent by the server?

I want to be able to prove that a given content returned by a HTTPS server was in fact served. I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's ...
5
votes
1answer
83 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
2
votes
1answer
93 views

Are TLS session keys cached in a browser?

For example, when authenticating to a TLS protected service, and then closing the tab, you can sometimes reconnect to the service afterwards without re-authenticating. In preservation of perfect ...
0
votes
2answers
78 views

Do modern cryptographers / cryptoanalytics need the knowledge of historical cryptography

It makes a lot of sense for people to know the history of their profession from various points of view and I suppose especially in cryptography because people can still use old ciphers and no one ...
2
votes
3answers
54 views

Chaining multiple PGP keys

I would like to know the practical limitations to contact chaining multiple peoples pgp key's in order to protect a file. In normal public key cryptography, four keys are required, public and private ...
2
votes
2answers
61 views

Authenticated encryption (Symmetric encryption) for .NET applications [closed]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
0
votes
1answer
57 views

Using the index of characters in a security question [duplicate]

I'm seeing many sites offering one or two "security questions" that have to be answered by choosing characters at specific indexes, in addition to username + password. For example: "What is your ...
8
votes
1answer
100 views

Attacks on keys generated with low entropy

If I were to give someone a two 4096 bits keys, and say one was generated in a Linux OS with very very low entropy available, and one was generated in a Linux OS with more than enough entropy. Would ...
6
votes
2answers
287 views

How much entropy is good enough for seeding a CSPRNG?

I have some fundamental questions on using Cryptographically Secure Pseudorandom Number Generators (CSPRNGs). What should be the size of the seed that I initialize a CSPRNG with? How often should I ...
3
votes
1answer
137 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
0
votes
1answer
85 views

Is this data encryption process secure?

I have created the following encryption process which I will be using to store CD keys inside my database. Before I use it, however, I need to make sure that this is as secure as possible. From what ...