Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
3answers
185 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
0
votes
1answer
200 views

Tracking information on HTTPS connection

My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
0
votes
1answer
743 views

Is TLS secure when full eavesdropping on the network occurs? [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? Alice connects to Bob's site via a TLS secured connection ...
3
votes
3answers
1k views

Hash Function Xor

For a hash function what is the best secure method, XOR or Concatenate: h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
3
votes
1answer
171 views

Updating stored, encrypted containers on a server

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
5
votes
1answer
170 views

Detecting PRNG Use from Output

Question: Is there a way to detect the use of a PRNG strictly from observing the output provided by an application? Background: During an audit of a key generating algorithm that I knew was based on ...
3
votes
1answer
328 views

Kerberos realm understanding

Could someone summarise why realms are necessary in Kerberos and the advantages of the concept. I'm struggling to isolate everything I know / beginning to understand into some well defined points for ...
4
votes
3answers
2k views

Is a 512 bit RSA key secure when used temporary?

Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data. This is for a system where ...
1
vote
2answers
407 views

Can I use hardware token OTP to stop piracy?

Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
5
votes
2answers
2k views

how strong is AES without salt

The AES cryto library provided to us from company, does not generate a different encrypted value for plain text. If text is "abcd" , it will generate the same encrypted value over multiple ...
1
vote
1answer
516 views

Storing Private Keys Generated on Server with specific User's Password Securely

I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
5
votes
1answer
556 views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
18
votes
2answers
39k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
2
votes
1answer
705 views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
4
votes
1answer
231 views

Combining MAC and Encryption

What is the most preferred and secure way of combining both Encryption and MAC. There was a lecture on different combining strategies adopted by different protocols on a cryptography course by ...
5
votes
1answer
1k views

OpenVPN Why CBC mode is recommended?

I just set up my installation of OpenVPN on my server. I am curious why the OpenVPN manual recommends CBC mode. I heard that CBC is predictable and not secure; is that true?
1
vote
1answer
124 views

Reasonable computationally lightweight security?

I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible. What if the ...
22
votes
7answers
1k views

At what level of abstraction should a developer work with with regards to cryptography?

I have recently came across an old blog post by Jeff Atwood which got me thinking. What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
3
votes
0answers
68 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
2
votes
3answers
2k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
3
votes
2answers
1k views

What hardware technology (GPU, FPGA) is fastest at generating RSA keys?

I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
162
votes
8answers
71k views

Why not use larger cipher keys?

RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
22
votes
7answers
5k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
4
votes
3answers
646 views

Impact of Quantum Computers, other than new algorithms

When large scale quantum computers come along, algorithms based off of the new principles will have an impact on how we encrypt data, with Shor's algorithm rendering RSA vulnerable and Grover's ...
16
votes
5answers
1k views

Rainbow table concept for Prime numbers

Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
0
votes
1answer
1k views

ECDH is better than plain RSA? [closed]

RSALabs recommend using at least 4096 bit long RSA keys to encrypt emails but we have some performance difficulty with 4096 RSA. my noob question is what is ECDH (i didn't understood from wikipedia ...
10
votes
3answers
883 views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
1
vote
4answers
558 views

RSA and encrypted authentication

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
1
vote
1answer
252 views

Secure Encrypted Chat Protocol [duplicate]

Possible Duplicate: Is there a way to negotiate a secret between 2 parties with no prior knowledge? Imagine two clients who want to establish a secure connection over a server. Both clients ...
2
votes
3answers
190 views

Given a large enough sampling of public keys could one begin to identify a private key?

For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
4
votes
3answers
517 views

Two step encryption

Consider the following user case: I have some sensitive data (eg: credit card number) I encrypt this data and store it in the database Now I want to send this data to a user X, but I don't want to: ...
2
votes
1answer
227 views

Design of Initialisation Vector

I understand that an IV (initialisation vector) should be both unique and unpredictable, but I have found little guidance as to which is most important. For an AES cipher I have a block size of 128 ...
69
votes
13answers
6k views

VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?

I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
-3
votes
2answers
94 views

Any good products that could crypt the files stored in laptops? [closed]

Thefts of laptops have become very common at my place, and losses of sensitive information is a a major concern for my businesses. So I wonder if there is any good products out there that could crypt ...
3
votes
1answer
199 views

Can we use a public key scheme for performing cryptographic commitment

Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
5
votes
5answers
1k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
2
votes
1answer
285 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
2
votes
1answer
1k views

Clarification on how rainbow tables work

If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm for "Key in Hex" enter 00000000000000000000000000000056 for "Plaintext in Hex" enter 00000000000000000000000000000000 and click on ...
1
vote
1answer
190 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
5
votes
1answer
278 views

Trusted Timestamping Scope and Real-World Uses

What security assurances does Trusted Timestamping based on Cryotography provide? What are the real-world uses of Trusted Timestamping?
26
votes
5answers
2k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
337 views

Detecting end-state of decryption process with unknown key

Note: this question arises purely from a theoretical interest in security research. Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While ...
16
votes
6answers
2k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
5
votes
1answer
298 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
9
votes
3answers
1k views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
1
vote
1answer
223 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
12
votes
1answer
1k views

TrueCrypt, Master password possible?

I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have. Now, from what I know about how TrueCrypt ...
2
votes
2answers
1k views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
2
votes
1answer
1k views

What would be the scenario if P = NP for RSA algorithm?

Suppose I am using RSA for my security system. Now someone discovers find a polynomial time algorithm for RSA. Then what measure should one that such that RSA never breaks. Maybe large number of used ...
5
votes
2answers
3k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...