Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

3
votes
1answer
107 views

Windows Phone and Hardcoding Values

Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
1
vote
1answer
127 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
475 views

What is a man in the middle attack?

My university provided me with the following slide which is confusing me: From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
2k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
80 views

Determine the Identity of Caller

Let me explain my situation. I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-5
votes
1answer
6k views

Asymmetric encryption algorithms [closed]

What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
10
votes
2answers
577 views

What are the practical uses of large asymmetric keys?

The Windows CNG supports keys of varying sizes, e.g. RSA up to 16384 bits: http://msdn.microsoft.com/en-us/library/windows/desktop/bb204778(v=vs.85).aspx. My understanding is that in crypto today we ...
3
votes
1answer
179 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
268 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
2
votes
1answer
453 views

Hash extension(padding) attack

I recently came across this website talking about sha1 padding attack. http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/ After reading here are some of my doubts: How ...
2
votes
1answer
391 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
3
votes
1answer
292 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
1
vote
1answer
6k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
3
votes
4answers
403 views

Is it possible to configure any of wifi protocols so that the network is undetectable?

I am wondering if it possible to configure my DD-WRT router so that the wifi network I am using is undetectable - impossible to tell if there is any network broadcasting even if there are clients ...
4
votes
1answer
207 views

Switching to new encryption method (without losing data?)

Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
4
votes
3answers
317 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
1
vote
1answer
273 views

Cryptography Online Education [closed]

Do the security experts at IT Security have a preference between the two cryptography courses offered by Coursera (Stanford), "Cryptography I" and Udacity, "Applied Cryptography"? I am seeking an ...
4
votes
1answer
269 views

3DES with fixed-encoded random key

I need an advice. I have a communication protocol using 3DES cipher. Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server ...
4
votes
4answers
3k views

Why do you need message authentication in addition to encryption?

I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states: Authenticated encryption is a form of encryption that, in addition to providing confidentiality ...
6
votes
3answers
1k views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
1
vote
2answers
1k views

Questions to hybrid encryption. RSA with AES

I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net) byte[] aesKey = ...
7
votes
1answer
1k views

zero knowledge proof - where do we use it?

zero knowledge proof, Where do we use it online? I thought we mostly use the RSA algorithm.
3
votes
1answer
926 views

ECDH and Forward Secrecy

I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, ...
5
votes
2answers
2k views

Symmetric or asymmetric encryption for JSON Web Token?

We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token. There appear to be two options for ...
4
votes
2answers
762 views

How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter ...
11
votes
4answers
2k views

Is there a length beyond which increasing password length provides no additional security?

Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security? Since the hash will have a ...
2
votes
1answer
66 views

Parameters in output of password hashing function

A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format: ...
21
votes
2answers
15k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
6
votes
1answer
6k views

Exchange of DEK and KEK (encryption keys) between app server and key server

In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
2
votes
2answers
791 views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
1
vote
3answers
192 views

Cryptography key gathering tool [closed]

I am wondering if there exist a tools which can return the value of the one of the private key if the following are known: 1) Encryption Algorithm 2) Public key 3) Plain text 4) Cipher text Or may be ...
12
votes
3answers
3k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
2
votes
2answers
211 views

Many-time pad on image data, how to proceed?

I have raw image data that is XOR-encrypted with a fixed-size one-time pad repeated over the length of the image. I know what the format of the image data container is so I can successfully retrieve ...
5
votes
1answer
261 views

Security and authentication problem

We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes. First of all, lets imagine a real world scenario: Imagine that a user ...
6
votes
1answer
5k views

Will double encryption increase the security of cipher vs bruteforce?

Assume I have a function encrypt(mes,key) where mes is the message, and key is the key. The length of key is 64 bits. Last but not least: assume the only way to crack my cipher is a brute-force ...
14
votes
8answers
3k views

Is advanced mathematics relevant to security beyond cryptography?

Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, ...
17
votes
3answers
6k views

What specific padding weakness does OAEP address in RSA?

It's been recommended to use OAEP when padding messages to be encrypted via RSA, to prevent known plain text attacks. Can someone elaborate this in better detail? I'd specifically like to know the ...
4
votes
3answers
429 views

Can encryption twice with two keys in different sequences lead to the same result?

I am looking for an encryption algorithm for one of my current papers. The basic requirement is that, suppose I have two keys k1 and k2, and the E(k1,t) means encrypt t with key k1. Are there any ...
2
votes
2answers
590 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
4
votes
1answer
250 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
5
votes
5answers
37k views

Cracking CISCO ASA Passwords

I've got a copy of a Cisco ASA config and i want to crack the following example passwords I've got the following lines in the config ASA Version 8.4(2) ! hostname ciscoasa enable ...
4
votes
2answers
224 views

Ethernet security

I have a simple question that many people probably have and yet there does not seem to be a topic on this. I am visiting a company for a meeting and I have my laptop with me. This company is our ...
4
votes
2answers
7k views

How X509 Certificates are used for Encryption

I have small doubt regarding the process of X509. I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
3
votes
5answers
1k views

The security level in hash function

What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
5
votes
2answers
1k views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
3
votes
2answers
325 views

Securing Time Sensitive Data

I have a number of time sensitive, embargoed pieces of information that I need to distribute over the Internet and have received at a precise time. I'm currently dealing with the problem by uploading ...
2
votes
1answer
1k views

sha-512 vs sha-3? [duplicate]

Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512? "Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
1
vote
2answers
6k views

Why does OpenSSL not include AES-256-GCM? [closed]

I'm trying to implement AES-256-GCM in Ruby. Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this. However, neither 0.9.8r (which I had ...
0
votes
4answers
839 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
1answer
136 views

Securing the SOAP Messages

One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP. My client has the following suggestions: Encrypt the sensitive data with AES ...