Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

3
votes
3answers
138 views

Methods for determining if a file is encypted?

I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.) Basic Operation: ...
35
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
0
votes
2answers
96 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
0
votes
1answer
55 views

What are the requirements for private keys in Diffie-Hellman key exchange algorithm

Basically question is: If we have pof size 2048 what sizes for private exponents should Alice and Bob choose and why?
5
votes
1answer
105 views

How bad it is to feed /dev/random with /dev/urandom?

I have seen many blog posts, or blog comments which recommends to feed /dev/random entropy using output from /dev/urandom. I'm not a crypto expert, but it looks like a good way to replace hard-to-...
1
vote
0answers
52 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
0
votes
1answer
101 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
7
votes
3answers
1k views

What are the disadvantages of using public key cryptography when encrypting files? [duplicate]

I am wanting to encrypt a file with my public key, my friend told me that this is not a good idea but did not explain why. Can someone explain please.
0
votes
2answers
107 views

Is open source a good option for cryptography libraries? [closed]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...
0
votes
0answers
29 views

security authentication protocol [duplicate]

I'm "creating" a secure authentication protocol for my system and it is this: C-> S C S-> C N(once) C-> S Kc,aut[N] S-> AUT Ks,aut[C,Kc,aut[N]] AUT-> S Ks,aut[N] the line : X ...
1
vote
3answers
219 views

Why don't the majority of today's malware use strong cryptography?

While reading another story of botnet takedown, my wondering has reached its apogee: Why don't malware authors use cryptography (encryption + signing) provided by good libraries when their creations ...
0
votes
1answer
219 views

How does the Signal Protocol, used by WhatAapp, work?

I want to understand the process of the Signal Protocol. I have google it, but I am unable to find any good article or tutorial. I want to understand the basic definition and functionality of the ...
1
vote
1answer
107 views

AES step by step

I can't seem to find an AES tutorial that starts from Unicode to Cipher text. All of the tutorials I found starts with 128 bit block already. Also, where do I start or what topics do I have to start ...
9
votes
2answers
861 views

techniques to detect & mitigate Crypto-ransomware?

Crypto ransomware attacks are the latest concerns for our organization, we need to verify if we are adequately protected from them & if affected, what are the generic mitigation measure? How do ...
1
vote
0answers
39 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
69 views

Cryptography behind RedHat subscription system (DRM)?

I have to do a project like a subscription manager. Ideally this should work like RedHat subscriptions. I'm having a hard time figuring out how it was implemented. How do they manage to avoid a ...
3
votes
1answer
97 views

What would be the repercussions in Information security, if someone found a way to factor large numbers quickly?

I am curious as to how exactly cyber-security would be affected if someone found a way to factor a large number quickly into its multiples. Let's assume that the time required for factorization is ...
4
votes
2answers
71 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...
3
votes
1answer
75 views

Is having a unique key to encrypt data not sufficient

Is it necessary to use a unique Initialization Vector (IV) with various cipher modes of operation (e.g. CBC) even though I use a unique key to encrypt plain text every time? It is said that an IV ...
-1
votes
1answer
65 views

What defines a “good” cryptographic algorithm? [closed]

The title pretty much says it all. I am looking for a formal definition of what a good crypto algorithm is. I cannot find anything online.
0
votes
1answer
67 views

how is public key being exchanged in asymmetric cryptography?

I understand that exchanging public key between parties is challenging task in asymmetric cryptography.Can someone help me understand how it is achieved?
1
vote
1answer
66 views

Hide data from user, but process it in application

Is there a way to hide the data that's received somehow from the user? In particular, I have some data that gets send from a webserver to an application. I want the application to process the data, ...
2
votes
1answer
86 views

Question on MAC(Message Authentication code)?

I am new to Cryptography and unable to understand clearly about MAC concept. As per MAC concept, Sender 'A' will encrypt the original message with symmetric key to create MAC1 value and then will send ...
3
votes
1answer
69 views

Is this good/secure method for client-server communication encryption?

Something came to my mind, and I wonder if this is proper method for client-server communication, and if this method is wide-used. On connection, client generates seed, encrypts it using asymmetric ...
2
votes
1answer
108 views

Can an attacker make in-app-purchases of my products in their app?

My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle. Apple's In-App-Purchase system allows ...
9
votes
1answer
193 views

How do EMV contactless cards protect against replay attacks?

I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the ...
4
votes
2answers
104 views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: http://www....
2
votes
2answers
112 views

Are there any security advantages to the “TrueCrypt-Paradigm”?

TrueCrypt and its successors use a file format that has the special property, that it looks completely random, there's only a salt (which is random) and the cipher text (which looks random). I like to ...
3
votes
5answers
619 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
4
votes
1answer
157 views

What are active research topics in SSL/TLS?

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here. I am interested in doing ...
2
votes
4answers
198 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
0
votes
0answers
29 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
1
vote
0answers
30 views

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
2
votes
2answers
115 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
1
vote
0answers
51 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
9
votes
1answer
140 views

How to compare key management strategies

Are there formal security definitions or frameworks to evaluate the quality of a key management scheme? Can I state something like "the key is XYZ-protected against a polynomial adversary given that [...
-3
votes
2answers
82 views

How do I know if a string is a cipher? [closed]

Hhello everyone. I have this string here: 697yqf3e3d9e3ej6d80y34y7jq Is it a cipher? I've tried to decode it as a cryptogram. It didn't work. How do I know if something is a cipher?
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...
3
votes
1answer
197 views

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
0
votes
0answers
27 views

Secure transfer with proxy person in the middle

I am new to cryptography, so I would like some validation. I have an unusual use case that I haven't found described anywhere and would like to get some help validating my approach. Alice needs ...
2
votes
0answers
138 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
1
vote
0answers
47 views

Are OpenStack SSH keys secure? [closed]

I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs. Is this configurable? I have read and heard here (How can you securely ...
2
votes
2answers
64 views

Does Thunderbird Enigmail plugin decrypt attached files?

From my research I have found out that you can easily send encrypted messages to one another using Enigmail. If first I encrypted a file,then attached it to an email, sending it through Enigmail to a ...
4
votes
3answers
192 views

How to decrypt a file encrypted under multiple public keys GPG

According to https://www.gnupg.org/gph/en/manual/x110.html To decrypt a message the option --decrypt is used. You need the private key to which the message was encrypted. Similar to the ...
-4
votes
1answer
95 views

Friend sent me a text and is encoded could anyone decode and tell me what it is? [closed]

I have been searching for hours to find out what this is but I have had no luck, would anyone mind helping? We are geeks so we do this all the time but I have never seen an encoding like this "Mlac ...
1
vote
1answer
37 views

GPG/Bitcoin usb gadget device

My idea is to take a raspberry pi zero (or any embedded linux board) and shove GPG inside it to encrypt/decrypt/sign data with RSA/ECC (for bitcoin) via USB. Like a USB thing that holds your (...
0
votes
1answer
87 views

How many hashes do I need to compute to get x collisions?

I know that you need to hash about 2^(N/2) to find a collision taking into account the birthday problem. But I'm not really sure about more than one collision, I mean, collisions with different ...
2
votes
1answer
56 views

The Requirements of a Cryptographic Algorithm [closed]

I remember reading a book on cryptography with a section detailing the objectives that modern cryptography must accomplish, one being that even if the algorithm is known, the method remains secure. I....
1
vote
1answer
84 views

Fast data integrity protection

I have a small device with a 16-bit (embedded) architecture, which transmits 1500 bytes every 3 milliseconds. This device has no built-in integrity protection, and it is possible to manipulate the ...
0
votes
1answer
48 views

Why the private key is not present for the certificate retrieved from the personal information exchange file?

certificate data is retrieved from the personal information exchange using the following Crypto API's hCertStore = PFXImportCertStore( &data, wszPassword, CRYPT_EXPORTABLE ); ...