Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
2answers
125 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications ...
1
vote
0answers
53 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
1answer
100 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
79 views

Steganography concept - How to check my implementation? [closed]

I have written my own software to do Steganography. Basically, I am dividing the message (text) into bits and then hide them into pixels in jpg. After that I am saving the bitmap into .png (because ...
1
vote
2answers
116 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey ...
1
vote
2answers
57 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
3
votes
0answers
79 views

Is there a benefit in measuring randomness? How would it be done?

Is there any benefit in determining how random a given file, stream, signal is? I guess this would be useful to determine If something is (poorly) encrypted To verify the proper encryption of a ...
10
votes
4answers
1k views

Possible to read strength of encryption?

With the recent talks of governments trying to weaken encryption, I had a question about how they would implement it. For example, let's just say that the government banned anything above AES-128. I ...
5
votes
1answer
111 views

Resetting the Windows RNG

According to this research, Windows seems to produce the same sequence of random numbers indefinitely when a process is kicked off before a VM snapshot is taken. This is a huge issue obviously when ...
48
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
220 views

Crack 512-bit RSA encrypted messages without a private key?

I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have ...
3
votes
2answers
151 views

In Ephemeral Diffie Hellman Key Exchange - what is actually ephemeral?

Just starting to learn about Diffie-Hellman, and it seems simple enough, but I am struggling to find any resources that explain in an Ephemeral Diffie Hellman Key Exchange, what it is that is actually ...
1
vote
2answers
158 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
1
vote
0answers
36 views

Is there a point in cascade encryption? [duplicate]

I was reading the other day about some programs (ex: DiskCryptor), and with my limited knowledge of cryptography.. I started wondering about cascading encryptions (ex: AES-Twofish-Blowfish). Assuming ...
-1
votes
2answers
117 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
3
votes
0answers
241 views

How Does Telegram's Identity Verification Work?

Note: please refrain from commenting on Telegram's design of OTHER parts, as it will distract from the stem of the question. Background: Signal (Previously, "TextSecure" app) uses specific "Your ...
0
votes
1answer
162 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
1
vote
1answer
43 views

«Secret ballot» requirement for a distributed e-voting system

There are lots of discussions about electronic voting vs paper-based voting and technical concerns about it. So here's another one. There are some concepts that are very similar to cryptocurrencies ...
3
votes
1answer
79 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
4
votes
4answers
161 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
1answer
118 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
7
votes
1answer
189 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
7
votes
3answers
1k views

Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?

Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications. I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt as I know, if ...
2
votes
3answers
63 views

Stacking Encryptions (Stream over Block)

I am reviewing the code for a product our team developed where credit card information is stored in a local database in the event of no internet connection and came across the encryption methods. The ...
-1
votes
1answer
37 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
1
vote
1answer
88 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
1
vote
2answers
145 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
3
votes
3answers
81 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
2
votes
1answer
87 views

Security risks of symmetric encryption with compression for database data

I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface. Various ...
1
vote
1answer
261 views

Bypass SSL Certificate Pinning using SSL Vulnerablilities

I am wondering if it could be possible to sort of "bypass" the certificate pinning protection of Android or iOS using for example the POODLE SSL vulnerability. According to this blog Entry it is ...
-6
votes
1answer
134 views

Base64 Decoding [closed]

00CDu000000000000000000000000000006e0QW00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001W00000000000000000000000000000000000000000 ...
0
votes
2answers
662 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
2
votes
2answers
134 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
-1
votes
1answer
80 views

Double encryption vs single encryption

So I understand that double encryption would do no more than possibly double the time taken to break a single encryption, as the key size of double encryption would be 2k-bits and the size of single ...
0
votes
1answer
48 views

Padding in CBC mode

Hi I have just started learning about ciphers and padding, and just wanted to know why is padding needed in CBC mode encryption, is it to get the blocks to all be of the same n-bit length? And why is ...
1
vote
2answers
107 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
1answer
98 views

AES_GCM and TLS sequence number

Am I right about that AEAD encryption/decryption uses a TLS sequence number twice, first time in the nonce and a second in additional data? And why did they make the TLS 1.2 sequence number 2 times ...
6
votes
1answer
159 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
3
votes
1answer
126 views

Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
3
votes
2answers
157 views

How to 'pair' a client/server application securely?

Please forgive me if my question is a rephrasing of a common problem, but I am not sure what to search for! My use-case is a client-server program. The server runs on a user's PC and the client runs ...
9
votes
2answers
733 views

How the NSA can break trillions of encrypted Web and VPN connections

Based on Diffie-Hellman's negotiation of key exchange, why would it turn out that only a few primes are commonly used? What and who determines the prime? Would it not be safer to use a safe prime? ...
2
votes
1answer
30 views

Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string

I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution. Here is the problem: www.domain-a.com is a secure website dealing with customer ...
2
votes
0answers
112 views

Deciphering “easy” ciphers without hints [closed]

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic ...
3
votes
1answer
115 views

LibTomCrypt weird ECC Keys

I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography. In my first little program I created an ...
0
votes
1answer
189 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
3
votes
2answers
178 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
0
votes
2answers
214 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-3
votes
1answer
47 views

What are the implications of differences in confidentiality timeliness?

From a security standpoint, what are the differences that must be addressed between data with a day-long confidentiality timeliness and data with timeliness of a year or more?
0
votes
1answer
63 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...