Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

1
vote
1answer
31 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
0
votes
1answer
58 views

Why does the finance industry uses 2TDEA instead of 3TDEA?

Why does the finance industry uses 2TDEA instead of 3TDEA; is there any historical reason or technical limitations like the support by HSMs used in the industry? The paper referred to here says ...
1
vote
2answers
103 views

Efficacy of self-made ransomware protection

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known ...
7
votes
4answers
939 views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
0
votes
1answer
60 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
0
votes
1answer
56 views

Key Exchange using RSA

I'm trying to do key exchange using the following scheme. Server generates an RSA-2048 key pair and sends the public part to the client Client generates an RSA-592 key pair (I have to use RSA-592 ...
-1
votes
3answers
55 views

Full control on cryptography vs relying on external certificate [closed]

I have a question with regards to having full control on the cryptography which you will be using for your own application vs relying on external entities such as certification authorities? What are ...
0
votes
1answer
79 views

rolling code & keyless entry system [closed]

The security industry typically uses rolling code algorithms to authenticate sender & receivers in keyless entry systems, which is called RKE (ex: KeeLoq). In key-less smart key car system, The ...
3
votes
2answers
65 views

Link Layer authenticated encryption vs authentication

Many security articles discuss about adding an extra layer of security at the link layer by either authenticating the data at the link layer authenticating and encrypting it. If we have ...
0
votes
0answers
13 views

gpg2 - no option to select aes block cipher and outdated use agent? [migrated]

With OpenSSL, I can select a what type of block cipher to use for encrypting a file. For example, if I want to encrypt a file with AES256 CBC block cipher mode: openssl aes-256-cbc -a -salt -pass ...
-1
votes
3answers
102 views

Is information security based entirely on mathematics [closed]

I started to show interest in information security few months ago, the more I read the more I think it's all about mathematics not information techonolgy. I mean the whole thing is based on encryption ...
1
vote
1answer
35 views

Real-world applications of Differential Privacy?

Differentially private techniques guarantee privacy while often permitting accurate answers ...this is something I have been reading up on lately as a means of preserving user ...
2
votes
0answers
7 views

Viewing and listing keys in MSCAPI CSP containers [migrated]

I have a MSCAPI container created and hosted within a Windows Server 2003 environment. How do I use the command line to list keys and their details within the container onto the command line ?
15
votes
4answers
2k views

Why should I sign data that's already encrypted? [duplicate]

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it? Doesn't the PKI encryption inherently provide ...
0
votes
1answer
34 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
3
votes
3answers
166 views

Is there any security gain / risk by adding additional padding (beyond what is required) when using AES-256 to encrypt very short strings?

I would like to encrypt some authentication tokens using AES 256 (not tied to this algorithm but it seems to be a reasonable choice). These messages are usually very short at 128-256 bits. I'm ...
0
votes
1answer
59 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
0
votes
2answers
73 views

Encrypting using the private key in Identity-Based Cryptography

In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
0
votes
2answers
61 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
0
votes
0answers
33 views

How does Spideroak manage encryption keys

I'm trying to understand the following from SpiderOak's engineering page (sorry I'm on a mobile phone so have no access to formatting functions like quote blocks): "SpiderOak uses a nested series of ...
0
votes
1answer
95 views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
1
vote
1answer
50 views

What is the purpose of “g” -> generator of the multiplicative group

I am currently beginning to studying the different security protocols and came across the SRP secure remote password protocol. I manage to understand the mathematic formulas behind it and the ...
1
vote
0answers
26 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
37 views

How is this SHA-1 hash generated? [closed]

If you get a disposable email from say guerrillamail.com, and then fill out the forgot my password page at dahorta.org/app/index.php/cliente/resgatar_senha, it emails you a link to reset your ...
4
votes
1answer
85 views

Is there a secure way to create and distribute Shamir Secrets?

This Shamir Secret sharing utility consumes the secret key, and then generates N keys that must be manually distributed to each person. This is probably fine for most low-security situations, but not ...
0
votes
1answer
89 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
0
votes
1answer
250 views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
0
votes
2answers
64 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
1
vote
2answers
64 views

Do DES keys have to be random?

In stream cipher (namely the OTP ) . The pad which the plain text is Xored with has to be random to achieve perfect secrecy , or psudorandom to ensure semantic security Dose this apply to DES or ...
0
votes
3answers
130 views

Did the “Malicious SHA-1” technique enable the NSA to insert a backdoor into SHA-1?

SHA-1 was standardized by the NSA. It appears to be possible to choose the constants in such a way that collisions can be derived easily. Yet, it is not easily possible to discover that the constants ...
0
votes
0answers
56 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
0answers
36 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
4
votes
2answers
101 views

How does an insecure RNG affect cryptography, and how do I measure the corresponding loss of security?

Suppose a given random number generator has poor entropy, and is compressible by any compression algorithm (zlib, bzip2, lzma, etc). Specifically the issues with this RNG are: Bad entropy Bad seed ...
2
votes
2answers
68 views

Securing fingerprint templates stored on web authentication server

I have a multi-factor web authentication server, that in addition to regular passwords uses fingerprints for user authentication. Can anyone think of a security flaw in the following scenario: I ...
0
votes
1answer
114 views

Bitdefender Antivirus SSL Cert substitution

I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as ...
0
votes
1answer
62 views

Will obtaining password hash compromise derived encryption key?

I've been looking at how PBKDF is used to generate encryption key for AES. One thing I couldn't get my head around is that how those OS keep the encryption key safe apart from using hardware modules. ...
0
votes
4answers
134 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
0
votes
1answer
55 views

Uniqueness of name in cryptography

If I publish my public key (I think I understand how this works, I'm still learning encryption) and I have a common name, could this leas to problems at all? OR does the email part guarantee that this ...
43
votes
1answer
3k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
2
votes
2answers
83 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
0
votes
2answers
65 views

Is there something similar to pseudorandom generators but in the opposite direction?

Pseudorandom generators (PRG) are functions that takes a random small input (called the Seed) and maps it into much larger output . However, the mapping process must be unpredictable in order for the ...
0
votes
2answers
72 views

How to generate a superkey to decrypt strings

I'm working on an application where users have a key or password generated by me that is used to encrypt a string. Each user has their personal key, and no user should be able to decrypt another ...
1
vote
1answer
101 views

How easy is it to crack this encryption algorithm? [closed]

When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
0
votes
1answer
32 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
2
votes
1answer
67 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
2
votes
2answers
94 views

What problem does ECC seek to fix compared to RSA?

Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC ...
0
votes
1answer
39 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
-2
votes
1answer
179 views

good books for learning network and web security? [closed]

I am reading "Hacking The Art of Exploitation" book . i have read till chapter 2 programming but most of it has gone above my head . I want to learn basically cryptography , network security and web ...
0
votes
2answers
107 views

Cryptography protocol suitable for two-way radio communications

Specifically talking about walkie talkie radio networks. Suppose there is a group of up to 16 persons, each equipped with such a unit. Typically, one person will be talking with one another ...
0
votes
0answers
33 views

Mobile App Processing Debit Card Transactions

I am creating a mobile app for iPhone and Android and the respective API that will be exposed to support the operations. This operations will require the customer to type the PIN to complete the ...