Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
1answer
46 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
1
vote
1answer
34 views

PBKDF2 strong salt

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So ...
0
votes
0answers
42 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
0
votes
1answer
85 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
2answers
61 views

How do certificates work in protecting against a man-in-the-middle attack? [duplicate]

As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. ...
0
votes
3answers
83 views

Constant time compares when array sizes are not equal?

What is the preferred or recommended way to pursue contestant time compares when array lengths are not equal? Should we exit as early as possible? Something like: if (array1.size() != array2.size()) ...
6
votes
3answers
214 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
9
votes
3answers
1k views

Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
2
votes
1answer
139 views

Arduino to Android secure bluetooth connection

I'm using an Arduino Uno and a nRF8001 board from Adafruit to connect to an Android phone over bluetooth. I will be using it to lock and unlock a lock and I need to make sure only verified devices are ...
1
vote
3answers
131 views

Would this generated CSRF token be considered cryptographically strong?

I am working on enhancing the security of an existing web application which currently has not implemented the use of anti-CSRF tokens, so it is up to me to generate one, add the hidden fields and ...
1
vote
0answers
230 views

Is Tox really secure? [closed]

There is a new Skype-killer application called Tox. They said that it's open source and that it protects its users against governments and other adversaries that try to collect your information. But ...
2
votes
2answers
116 views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
8
votes
3answers
1k views

Does the entire AES encrypted dataset have to be present to be 'cracked'?

I am implementing an AES 256 algorithm on credit cards and I am wondering if I would be strengthening or weakening the encrypted dataset if I split the dataset and persisted it in two locations. I ...
9
votes
2answers
144 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
43
votes
3answers
4k views

Is Git crowdsourcing cryptographic attacks?

A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed ...
0
votes
0answers
47 views

Suggestion of encrypt method for short fixed size result

I'm searching for a encrypt method that receives an int variable and outputs exactly 11 hexadecimal digits. I'm starting on a existing application, that already has a database of more than 130.000 ...
0
votes
1answer
60 views

Integrity-Based Execution

Intrusion Detection Systems (IDS) rely on binary signatures or known-bad-behavior of malware in order to detect threats. It has become very clear that this approach has limited success due to the fact ...
9
votes
4answers
4k views

Is Changing a File Type and Name an Effective Security Solution?

Is renaming folders & files and changing file types an effective solution for file security of a PC? I am an application programmer and have an extensive background in it. I have written a ...
1
vote
1answer
74 views

Calculating D-Wave's integer factorization capabilties

D-Wave has teased the ability to perform integer factorization previously, but if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization ...
2
votes
2answers
97 views

Why is GPG encrypted message size not proportional to number of recipients & file size?

I have noticed that when I am using GnuPG to encrypt a file for multiple recipients, the size of the encrypted message does not seem to be directly proportional to the number of recipients. For ...
7
votes
1answer
521 views

Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?

This is technically not even an attack. We have all the resources at hand, except for the original plain-text. We have the cipher-text (to be converted back to plain-text), as well as the key. The ...
4
votes
2answers
309 views

Including and storing the order of character entry in a password as an enhanced security measure

I'm sure I will be quickly corrected if this is a stupid idea, or if it has already been tried. My question is: has this idea been tried before? If not, are there good reasons it would not work, or ...
1
vote
0answers
51 views

Public keys Quality

Is there any way to test the quality of generated keys from a public key cryptosystem? I've read about the common RSA attacks, but attacking the algorithm may not mean checking if the generated keys ...
2
votes
3answers
150 views

Are there any flaws in this two way cryptographic function?

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works. Split the message into an array of 32-bit (or something ...
2
votes
2answers
108 views

how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet [closed]

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to ...
0
votes
3answers
226 views

How strong is a simple XOR encryption with random IV?

I'd like to implement some kind of simple (yet as strong as possible) encryption for my client-server application network traffic. Data to be encrypted can be both textual, and binary. Now I'm ...
0
votes
1answer
109 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
-1
votes
1answer
55 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
1
vote
1answer
122 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
0
votes
1answer
70 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
1
vote
1answer
384 views

How can you check if a private key and certificate match in OpenSSL with ECDSA?

I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs. With RSA keys, the ...
0
votes
1answer
460 views

AES 128bit decryption using a key longer than 16 bytes

I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt ...
0
votes
1answer
68 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
2
votes
0answers
93 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
1
vote
1answer
385 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
2
votes
4answers
398 views

How to prove to friend I have solution to puzzle (without revealing it)? [closed]

My friend Paul set me this arithmetic puzzle: To make 21 from the numbers 1, 5, 6, 7. You can use the operations add, subtract, multiply, divide as well as brackets. You must use each number once. ...
4
votes
2answers
282 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
1
vote
1answer
62 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
1
vote
2answers
113 views

POODLE and REST APIs

Are non-browser applications which do not contain an embedded browser, and merely make REST API calls over HTTPS, vulnerable to POODLE? And if not, is it unnecessary to disable SSL in such ...
0
votes
4answers
204 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
0
votes
1answer
120 views

Why is not safe to use the same public key in RSA?

In the RSA context, why is not safe to use the same n (public key)for different people?
0
votes
2answers
37 views

encryption using two keys

The use case is analogous to accessing a safe box in a bank. There is a per-user key, unique for each user, either generated by the system or hashed from the user's password. And there is a ...
2
votes
2answers
91 views

Encrypted container on top of a copy-on-write filesystem

The way I understand it, when you write to a copy-on-write filesystem, data never gets overwritten in place, instead new data is written to a new location, and the old data will only be overwritten ...
3
votes
1answer
105 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
0
votes
1answer
124 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
0
votes
0answers
21 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
18
votes
3answers
1k views

What is the difference between “key length” and “bit strength”?

On occasion, I hear the terms "key length" and "bit strength" used interchangeably. Are these the same things? Or are they different?
1
vote
2answers
115 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
-1
votes
1answer
46 views

Permutation based file secure

I have a thought. 1. Take a file. 2. Read number of bytes. If its less than 2048, padd it till 2048 3. Read each byte. And create a single file which contains the particular byte. Give a random name ...
1
vote
1answer
133 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...