Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms (1)

0
votes
0answers
31 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
1
vote
0answers
30 views

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
2
votes
2answers
121 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
1
vote
0answers
67 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
9
votes
1answer
141 views

How to compare key management strategies

Are there formal security definitions or frameworks to evaluate the quality of a key management scheme? Can I state something like "the key is XYZ-protected against a polynomial adversary given that [...
-3
votes
2answers
83 views

How do I know if a string is a cipher? [closed]

Hhello everyone. I have this string here: 697yqf3e3d9e3ej6d80y34y7jq Is it a cipher? I've tried to decode it as a cryptogram. It didn't work. How do I know if something is a cipher?
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...
3
votes
1answer
214 views

What would be a simple example of an asymmetric encryption function (asymmetric function)?

I am trying to understand RSA encryption but the algorithm seems quite complex. I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt ...
0
votes
0answers
27 views

Secure transfer with proxy person in the middle

I am new to cryptography, so I would like some validation. I have an unusual use case that I haven't found described anywhere and would like to get some help validating my approach. Alice needs ...
2
votes
1answer
180 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
1
vote
0answers
49 views

Are OpenStack SSH keys secure? [closed]

I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs. Is this configurable? I have read and heard here (How can you securely ...
2
votes
2answers
72 views

Does Thunderbird Enigmail plugin decrypt attached files?

From my research I have found out that you can easily send encrypted messages to one another using Enigmail. If first I encrypted a file,then attached it to an email, sending it through Enigmail to a ...
4
votes
3answers
221 views

How to decrypt a file encrypted under multiple public keys GPG

According to https://www.gnupg.org/gph/en/manual/x110.html To decrypt a message the option --decrypt is used. You need the private key to which the message was encrypted. Similar to the ...
-4
votes
1answer
95 views

Friend sent me a text and is encoded could anyone decode and tell me what it is? [closed]

I have been searching for hours to find out what this is but I have had no luck, would anyone mind helping? We are geeks so we do this all the time but I have never seen an encoding like this "Mlac ...
1
vote
1answer
37 views

GPG/Bitcoin usb gadget device

My idea is to take a raspberry pi zero (or any embedded linux board) and shove GPG inside it to encrypt/decrypt/sign data with RSA/ECC (for bitcoin) via USB. Like a USB thing that holds your (...
0
votes
1answer
90 views

How many hashes do I need to compute to get x collisions?

I know that you need to hash about 2^(N/2) to find a collision taking into account the birthday problem. But I'm not really sure about more than one collision, I mean, collisions with different ...
2
votes
1answer
59 views

The Requirements of a Cryptographic Algorithm [closed]

I remember reading a book on cryptography with a section detailing the objectives that modern cryptography must accomplish, one being that even if the algorithm is known, the method remains secure. I....
1
vote
1answer
85 views

Fast data integrity protection

I have a small device with a 16-bit (embedded) architecture, which transmits 1500 bytes every 3 milliseconds. This device has no built-in integrity protection, and it is possible to manipulate the ...
0
votes
1answer
51 views

Why the private key is not present for the certificate retrieved from the personal information exchange file?

certificate data is retrieved from the personal information exchange using the following Crypto API's hCertStore = PFXImportCertStore( &data, wszPassword, CRYPT_EXPORTABLE ); ...
1
vote
2answers
58 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
1
vote
3answers
151 views

Are there any problems with using CAMELLIA, IDEA and SEED based cipher suites on a web server in 2016?

I have recently seen CAMELLIA, SEED and IDEA cipher suites in use for HTTPS on a web server and am unsure what to suggest to the owner. The keys in use are all over 128 bits in length and standard ...
2
votes
1answer
157 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
1
vote
1answer
152 views

What is the format of an RSA public key?

I have this RSA public key from which I want to get Modulus and exponent part but not able to get the format in which it is encoded. Can someone please tell how to decode it? -----BEGIN PUBLIC KEY----...
0
votes
1answer
66 views

How to make a good choice between Symmetric and Asymmetric [closed]

Here and there and read a lot of articles and blog posts titled "Difference Between Symmetric Cryptography and Asymmetric Cryptography". But inside of them they are answered "What is Symmetric ...
2
votes
0answers
55 views

How rf remotes for “cloning” rolling code find matching codes?

I've been tinkering with a rf (garage door) remote control that has a scanner mode (google JMA SR-48 for details). This mode works for Mutancode and Erreka which I assume would be similar to KeeLoq. ...
0
votes
2answers
89 views

Information Security learning [closed]

I'm new in information security. I need some advices about how to start learning about this area. What are the courses I should take? From where can I start? Give me please an outline to pursue to ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
2
votes
0answers
38 views

GPG Public Key changes after removing master key [closed]

Why does my gpg public key change after removing my master key (leaving just my subkeys) from the gpg key ring? I'm doing this so i can move my daily use keys (subkeys) to my online machine while ...
0
votes
1answer
22 views

Keeping the same key and iv for encrypting post content

I want to encrypt and decrypt some wordpress posts. Only the content field i care about. Is it safe to use the same key and iv for the process?
3
votes
2answers
482 views

Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?

Are there any type of file whatsoever that can -not- be encrypted? Is there any data that can't be encrypted by the regular RSA encryption methods? Also, does anyone know what files the cryptolocker ...
1
vote
3answers
145 views

Is it possible for Apple or any other company to create fully encrypted smartphone?

From the latest Apple vs FBI story it's known that Apple is technically capable of changing the boot-loader of the iPhone to provide interface for brute-force finding of 4-digit password. I'm ...
0
votes
3answers
99 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
0
votes
0answers
21 views

Are there any known weaknesses in SignedXml by Microsoft for SAML?

SingedXml is a common way to verify the signature for SAML in .Net applications. I am wondering if it secure enough, i.e. there is no way to trick it (by making it verify not top-level Assertion or ...
0
votes
2answers
129 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
0
votes
1answer
51 views

Is there a 'key space' equivalent for encryption keys?

If a key space is the term given to the collection of all possible decryption keys for a given cryptosystem, then what is the collection of all possible encryption keys called?
1
vote
1answer
132 views

Covert, Overt, and side channels

I am really confused between the following three terms: Overt Channel. Covert Channel. Side-Channel. I feel frustrated! I've been searching about them to find a clear explanation but I keep ...
1
vote
1answer
54 views

Generation of a shared nonce that cannot be pre computed [closed]

Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
0
votes
0answers
54 views

Digitally signing a digital signature

When might it make sense to digitally sign a digital signature?
0
votes
0answers
62 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
-4
votes
1answer
85 views

How to encrypt/decrypt with only encryption hardware?

Alice and Bob have agreed a symmetric key to be used for encrypting messages to be sent over an insecure (wrt a passive adversary) communication channel. Both of them have hardware devices for ...
6
votes
3answers
306 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where bcrypt/...
3
votes
1answer
113 views

Is secret key for HMAC in form of UTF8 characters good enough?

There is a popular JWT library on nuget. I am analyzing an application that uses that library and it stores a secret key as a string. In the code of the library I see that it uses the MS HMACSHA256 ...
1
vote
1answer
80 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
4
votes
1answer
92 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
0
votes
0answers
78 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
1
vote
1answer
309 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
0
votes
1answer
67 views

Remote VPN access and moving to the cloud

First of all, my question is related to Web Application security. Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are ...
0
votes
2answers
407 views

Bitwise cipher Cryptography

I'm doing an online cryptography course. There is a question in which it is given that the encrypted text for; OwBPAAQXAE9UC0FVBQxODgZSCUUMAQwCCApYRBJZBR0LDhoAGApPHQAUAQNZRAJPGwQbDQBDDREKQA== Is ...
-1
votes
2answers
36 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
-1
votes
2answers
133 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...