Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
1answer
130 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
1
vote
1answer
130 views

What is the format of an RSA public key?

I have this RSA public key from which I want to get Modulus and exponent part but not able to get the format in which it is encoded. Can someone please tell how to decode it? -----BEGIN PUBLIC KEY----...
0
votes
1answer
62 views

How to make a good choice between Symmetric and Asymmetric [closed]

Here and there and read a lot of articles and blog posts titled "Difference Between Symmetric Cryptography and Asymmetric Cryptography". But inside of them they are answered "What is Symmetric ...
2
votes
0answers
47 views

How rf remotes for “cloning” rolling code find matching codes?

I've been tinkering with a rf (garage door) remote control that has a scanner mode (google JMA SR-48 for details). This mode works for Mutancode and Erreka which I assume would be similar to KeeLoq. ...
0
votes
2answers
89 views

Information Security learning [closed]

I'm new in information security. I need some advices about how to start learning about this area. What are the courses I should take? From where can I start? Give me please an outline to pursue to ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
2
votes
0answers
37 views

GPG Public Key changes after removing master key [closed]

Why does my gpg public key change after removing my master key (leaving just my subkeys) from the gpg key ring? I'm doing this so i can move my daily use keys (subkeys) to my online machine while ...
0
votes
1answer
22 views

Keeping the same key and iv for encrypting post content

I want to encrypt and decrypt some wordpress posts. Only the content field i care about. Is it safe to use the same key and iv for the process?
3
votes
2answers
452 views

Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?

Are there any type of file whatsoever that can -not- be encrypted? Is there any data that can't be encrypted by the regular RSA encryption methods? Also, does anyone know what files the cryptolocker ...
1
vote
3answers
142 views

Is it possible for Apple or any other company to create fully encrypted smartphone?

From the latest Apple vs FBI story it's known that Apple is technically capable of changing the boot-loader of the iPhone to provide interface for brute-force finding of 4-digit password. I'm ...
0
votes
3answers
97 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
0
votes
0answers
21 views

Are there any known weaknesses in SignedXml by Microsoft for SAML?

SingedXml is a common way to verify the signature for SAML in .Net applications. I am wondering if it secure enough, i.e. there is no way to trick it (by making it verify not top-level Assertion or ...
0
votes
2answers
128 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
0
votes
1answer
49 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
1
vote
1answer
115 views

Covert, Overt, and side channels

I am really confused between the following three terms: Overt Channel. Covert Channel. Side-Channel. I feel frustrated! I've been searching about them to find a clear explanation but I keep ...
1
vote
1answer
54 views

Generation of a shared nonce that cannot be pre computed [closed]

Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
0
votes
0answers
49 views

Digitally signing a digital signature

When might it make sense to digitally sign a digital signature?
0
votes
0answers
49 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
-4
votes
1answer
79 views

How to encrypt/decrypt with only encryption hardware?

Alice and Bob have agreed a symmetric key to be used for encrypting messages to be sent over an insecure (wrt a passive adversary) communication channel. Both of them have hardware devices for ...
6
votes
3answers
292 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where bcrypt/...
3
votes
1answer
104 views

Is secret key for HMAC in form of UTF8 characters good enough?

There is a popular JWT library on nuget. I am analyzing an application that uses that library and it stores a secret key as a string. In the code of the library I see that it uses the MS HMACSHA256 ...
1
vote
1answer
69 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
4
votes
1answer
90 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
0
votes
0answers
69 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
1
vote
1answer
309 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
0
votes
1answer
63 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
0
votes
2answers
398 views

Bitwise cipher Cryptography

I'm doing an online cryptography course. There is a question in which it is given that the encrypted text for; OwBPAAQXAE9UC0FVBQxODgZSCUUMAQwCCApYRBJZBR0LDhoAGApPHQAUAQNZRAJPGwQbDQBDDREKQA== Is ...
-1
votes
2answers
35 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
-1
votes
2answers
131 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
188 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
3
votes
3answers
162 views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
0
votes
1answer
52 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
12
votes
2answers
408 views

How difficult it was to crack Navajo's language during WW2?

It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language ...
2
votes
1answer
110 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
-1
votes
1answer
96 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
10
votes
3answers
357 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
7
votes
1answer
214 views

Encrypting individual files on OS X

I am about to go paperless, and I want to protect the documents that I scan. The use case is that I'll be scanning paper documents, encrypting each file, and storing them locally and on various backup ...
0
votes
2answers
66 views

Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible. Let X, A, B and C be arbitrary people from that group. Now X wants to encrypt a message ...
4
votes
1answer
190 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
3
votes
2answers
95 views

How can I create a secure random key for AES?

I need to generate a lot of shared keys for an AES method which uses in various condition, my concern is how can I generate unpredictable keys? I've had some research on Cryptographically secure ...
2
votes
1answer
89 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
-1
votes
1answer
67 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
5
votes
2answers
196 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
4
votes
3answers
189 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
-2
votes
2answers
176 views

How are people still copying and redistributing DRM-protected music

...when DRM-protected material is encrypted using the AES cipher, which there are currently no efficiently computable cracks for?
3
votes
1answer
98 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
0
votes
1answer
244 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
-2
votes
1answer
100 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
5
votes
1answer
102 views

How Can Malware Hide Using Cryptography

How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then ...
1
vote
0answers
27 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...