Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
4
votes
3answers
176 views
Can encryption twice with two keys in different sequences lead to the same result?
I am looking for an encryption algorithm for one of my current papers. The basic requirement is that, suppose I have two keys k1 and k2, and the E(k1,t) means encrypt t with key k1.
Are there any ...
1
vote
2answers
112 views
How high is the entropy of this salt-generating code? (No code-reading actually necessary)
What is the best method?
Assumption: I have a function that generates a number of medium-high entropy bytes
Step1:
I generate 3 of these medium-high entropy bytes.
Step2:
I hash these bytes using a ...
4
votes
1answer
172 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
1
vote
5answers
2k views
Cracking CISCO ASA Passwords
I've got a copy of a Cisco ASA config and i want to crack the following example passwords
I've got the following lines in the config
ASA Version 8.4(2)
!
hostname ciscoasa
enable ...
2
votes
3answers
183 views
An OS that does not trust its RAM?
I wonder if it is possible to write a kernel that would keep all of its RAM encrypted, storing the key in the CPU cache, so that the machine would be resistant to cold-boot attacks?
4
votes
2answers
132 views
Ethernet security
I have a simple question that many people probably have and yet there does not seem to be a topic on this.
I am visiting a company for a meeting and I have my laptop with me. This company is our ...
3
votes
2answers
349 views
How X509 Certificates are used for Encryption
I have small doubt regarding the process of X509.
I am aware of OpenPGP Encryption/Decryption, where we generate the public key and private key. We can share the public key to vendors and they can ...
3
votes
5answers
325 views
The security level in hash function
What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
3
votes
2answers
171 views
Is it reasonable to prevent timing attacks by using fixed processing time
I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing.
Part 1
Is it a good idea to ...
3
votes
2answers
87 views
Securing Time Sensitive Data
I have a number of time sensitive, embargoed pieces of information that I need to distribute over the Internet and have received at a precise time. I'm currently dealing with the problem by uploading ...
2
votes
1answer
175 views
sha-512 vs sha-3? [duplicate]
Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512?
"Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
0
votes
2answers
500 views
Why does OpenSSL not include AES-256-GCM? [closed]
I'm trying to implement AES-256-GCM in Ruby.
Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this.
However, neither 0.9.8r (which I had ...
0
votes
4answers
219 views
Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
1answer
72 views
Securing the SOAP Messages
One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.
My client has the following suggestions:
Encrypt the sensitive data with AES ...
1
vote
1answer
386 views
aes cfb 128 decryption /encryption problem between Erlang and PHP
Update 2 - it works
Thanks to Tom Leek for his answer.
The CFB mode of mycrypt for Rijndael uses a 8-bit feedback loop and not a feedback loop the length of the key/iv.
You have to force it to use ...
5
votes
3answers
226 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
2
votes
2answers
112 views
Easy protocol for email authentication
I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
3
votes
4answers
263 views
Can an attacker reuse stolen SSL private key to recreate that domain on his server
Say my domain (https://example.com) SSL private key has been stolen and was not protected by a passphrase then.
Can the attacker uses that key and certificate to host the same
domain on different ...
3
votes
2answers
142 views
What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?
I have learned there are 2 methods to make SSH remote login easier and secure , those are;
ssh generated keys (using ssh-keygen)OpenSSH Keys
PEM (.pem) keys usually generated with OpenSSL (Amazon ...
0
votes
2answers
77 views
What is the best way to generate keys in phpseclib?
I am using phpseclib implementation AES and HMAC. But I dont know the best way to create random keys for these.
What is the best way to do?
Is there any built in function in phpseclib to create keys ...
0
votes
2answers
183 views
What is the difference between protocols and algorithms? [closed]
I am learning network security and I can't understand the boundary line between protocols and algorithms.
Are algorithms the concrete realization of the protocols?
Are protocols composed of several ...
1
vote
5answers
283 views
Is SHA-1 encryption?
I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
1
vote
4answers
300 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
0
votes
3answers
110 views
Maintain sensitive key between requests
EDIT: Reworked question. Previous version too poorly asked.
On my website users write sensitive messages that must be kept secret.
The entire user area is over SSL, so the communication between user ...
0
votes
1answer
103 views
Tracking information on HTTPS connection
My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
0
votes
1answer
117 views
Is TLS secure when full eavesdropping on the network occurs? [duplicate]
Possible Duplicate:
How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it?
Alice connects to Bob's site via a TLS secured connection ...
3
votes
3answers
269 views
Hash Function Xor
For a hash function what is the best secure method, XOR or Concatenate:
h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
3
votes
1answer
86 views
Updating stored, encrypted containers on a server
My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
5
votes
1answer
101 views
Detecting PRNG Use from Output
Question: Is there a way to detect the use of a PRNG strictly from observing the output provided by an application?
Background: During an audit of a key generating algorithm that I knew was based on ...
2
votes
1answer
77 views
Kerberos realm understanding
Could someone summarise why realms are necessary in Kerberos and the advantages of the concept.
I'm struggling to isolate everything I know / beginning to understand into some well defined points for ...
5
votes
3answers
353 views
Is a 512 bit RSA key secure when used temporary?
Is a 512 bit RSA key secure when a new key gets generated and used approximately once a week? The key is only used for signing messages, not for encrypting sensitive data.
This is for a system where ...
1
vote
2answers
205 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
3
votes
2answers
300 views
how strong is AES without salt
The AES cryto library provided to us from company, does not generate a different encrypted value for plain text.
If text is "abcd" , it will generate the same encrypted value over multiple ...
0
votes
1answer
133 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
3
votes
1answer
158 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
4
votes
2answers
1k views
Security comparsion of 3DES and AES
Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)?
I need to use encryption for my projects to store and secure sensitive information ...
0
votes
1answer
153 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
4
votes
1answer
154 views
Combining MAC and Encryption
What is the most preferred and secure way of combining both Encryption and MAC. There was a lecture on different combining strategies adopted by different protocols on a cryptography course by ...
2
votes
1answer
226 views
OpenVPN Why CBC mode is recommended?
I just set up my installation of OpenVPN on my server.
I am curious why the OpenVPN manual recommends CBC mode. I heard that CBC is predictable and not secure; is that true?
1
vote
1answer
92 views
Reasonable computationally lightweight security?
I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible.
What if the ...
19
votes
7answers
611 views
At what level of abstraction should a developer work with with regards to cryptography?
I have recently came across an old blog post by Jeff Atwood which got me thinking.
What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
3
votes
0answers
59 views
Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]
Possible Duplicate:
How secure is aSSL (javascript)? Does it effectively mimic SSL?
After some searching around, I realized we don't have an easily visible canonical question about this on ...
0
votes
0answers
81 views
What McEliece key size can provide standard security today? [closed]
i don't wanna use RSA because it will be plaintext very soon but we can't stop using internet to send private data.
Does McEliece cryptosystem provide security today ?
What McEliece key size is ...
1
vote
2answers
454 views
KDC(Key Distribution Center) vs Asymmetric Key Exchange
Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network.
1st Method :
Make use of ...
-3
votes
1answer
132 views
What is the highest limit of security in the biggest agencies of the world? [closed]
A general question clicks in my mind, that there are many ways to bypass the security.
So, what is the highest degree of security?
2
votes
2answers
271 views
What hardware technology (GPU, FPGA) is fastest at generating RSA keys?
I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
130
votes
8answers
52k views
Why not use larger cipher keys?
RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
3
votes
3answers
228 views
Impact of Quantum Computers, other than new algorithms
When large scale quantum computers come along, algorithms based off of the new principles will have an impact on how we encrypt data, with Shor's algorithm rendering RSA vulnerable and Grover's ...
15
votes
4answers
644 views
Rainbow table concept for Prime numbers
Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
1
vote
1answer
252 views
ECDH is better than plain RSA? [closed]
RSALabs recommend using at least 4096 bit long RSA keys to encrypt emails but we have some performance difficulty with 4096 RSA. my noob question is what is ECDH (i didn't understood from wikipedia ...
