0
votes
1answer
24 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
0
votes
2answers
40 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
4
votes
1answer
69 views

Is there a secure way to create and distribute Shamir Secrets?

This Shamir Secret sharing utility consumes the secret key, and then generates N keys that must be manually distributed to each person. This is probably fine for most low-security situations, but not ...
0
votes
0answers
27 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
4
votes
2answers
92 views

How does an insecure RNG affect cryptography, and how do I measure the corresponding loss of security?

Suppose a given random number generator has poor entropy, and is compressible by any compression algorithm (zlib, bzip2, lzma, etc). Specifically the issues with this RNG are: Bad entropy Bad seed ...
0
votes
2answers
68 views

How to generate a superkey to decrypt strings

I'm working on an application where users have a key or password generated by me that is used to encrypt a string. Each user has their personal key, and no user should be able to decrypt another ...
0
votes
1answer
30 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
2
votes
1answer
60 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
0
votes
1answer
31 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
2
votes
1answer
84 views

Properties of AES Encryption

First of all, I apologize if these questions can be answered using a web search, but I'm sort of a crypto noob and don't know what to search for. Given N AES encrypted messages (where the message ...
1
vote
2answers
246 views

What's the point of the nonce in CTR mode?

Does having a nonce in CTR mode actually improve security (vs. just using 1, 2, 3, etc. - basically a constant nonce of 0)? As far as I can tell, the best-case scenario security-wise is that the ...
0
votes
0answers
58 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
0
votes
1answer
46 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
1answer
106 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
64 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
0answers
24 views

How digital certificate works? [duplicate]

I am trying to understand the digital certificate concept , but I am confused , Below goes my understanding & question, We are using Digital certificate because if Bob & Alice share their ...
1
vote
2answers
141 views

Is cryptography possible without volatile memory?

AFAIK, our current disk encryption methods (dm-crypt) preserve the key (as well as decrypted data) in RAM while the computer is running with an implicit assumption that the memory is volatile and key ...
0
votes
3answers
145 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
2
votes
1answer
88 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
1
vote
1answer
214 views

Safety of TrueCrypt hidden volumes

According to the documentation a hidden volume stays hidden because it appears as free space. In TrueCrypt free space always has random data in it, however in the case of a hidden volume it's not ...
2
votes
1answer
107 views

How secure is Vigenere cipher for random data?

Traditional situation It is easy to crack a ciphertext encrypted by Vigenere cipher, if you know the plaintext is in a natural language like English. There are two methods to discover the key used to ...
1
vote
1answer
40 views

Knowing Input&Output, How to determine encode method and the passkey that was used in encoding?

I've looked on this site and on SE. but I couldn't get a handle on this. Is there a way to find what type of encoding (and/or encode key) is being used? For example, I am testing a web ...
3
votes
5answers
241 views

How does one know when a message is successfully decrypted? [duplicate]

How do people who decrypt encrypted messages know they have decrypted to the correct message? Do they just keep decrypting until the message is in English (or any other language), or is there a ...
1
vote
0answers
111 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
3answers
114 views

Decrypting Engima messages

Not really computer related, but I hope someone has the answer. How do people decode messages from an Enigma machine? I understand that if you knew the rotors, rotor positions, and plugboard the ...
4
votes
1answer
74 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
1
vote
1answer
109 views

What is default mode for AES encryption [closed]

What will be the default mode for AES encryption if we don't use any specific mode like ECB, CBC, OFB, CTR, etc. and just carry out the encryption without specifying any AES encryption mode.
1
vote
2answers
114 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
1answer
110 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
1
vote
2answers
91 views

What are some examples of a block cipher's versatility over a stream cipher?

I understand that a block cipher can be made to act like a stream cipher at the cost of "losing versatility" of the block cipher for the sake of performance. I don't understand what I'd be losing. ...
-1
votes
1answer
122 views

Current Encryption Algorithms? [closed]

What are some encryption algorithms that are currently in use by secure websites, by operating systems, or by Secure USB thumb drive manufacturers. I am trying to do research on differences in speed ...
1
vote
1answer
67 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
1
vote
0answers
45 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
2
votes
1answer
128 views

Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?

note: Title edited to make the answer more useful to a wider audience I'm reading source code for encrypting files with AES GCM and see the following binary output. AdditionalAuthData IV ...
0
votes
2answers
101 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
15
votes
3answers
504 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
1
vote
3answers
323 views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
0
votes
1answer
79 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
1
vote
1answer
69 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
0
votes
5answers
153 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
146 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
3
votes
1answer
62 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...
3
votes
1answer
45 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
9
votes
1answer
188 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
1
vote
1answer
2k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated ...
1
vote
1answer
186 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
-5
votes
1answer
139 views

What is the excellence of RSA vs my algorithm [closed]

I was wondering that what make RSA Asymmetric Cryptography Algorithm special. So I wrote a very simple algorithm that do the same work (Generate Public and Private Key) Now I want to ask you that What ...
-1
votes
2answers
179 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
3answers
117 views

How to guarantee privacy on files that I store

I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use. e.g. A lawyer want to upload a sentence ...
10
votes
2answers
456 views

Forward secrecy for kids

In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers). I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...