Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
8
votes
3answers
141 views
Is it preferable to perform encryption using database functions or code?
Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL.
Most of the commonly used ...
1
vote
4answers
166 views
RSA and encrypted authentication
Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
0
votes
1answer
102 views
Secure Encrypted Chat Protocol [duplicate]
Possible Duplicate:
Is there a way to negotiate a secret between 2 parties with no prior knowledge?
Imagine two clients who want to establish a secure connection over a server. Both clients ...
2
votes
3answers
142 views
Given a large enough sampling of public keys could one begin to identify a private key?
For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
4
votes
3answers
218 views
Two step encryption
Consider the following user case:
I have some sensitive data (eg: credit card number)
I encrypt this data and store it in the database
Now I want to send this data to a user X, but I don't want to:
...
2
votes
1answer
108 views
Design of Initialisation Vector
I understand that an IV (initialisation vector) should be both unique and unpredictable, but I have found little guidance as to which is most important.
For an AES cipher I have a block size of 128 ...
60
votes
13answers
5k views
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
-3
votes
2answers
71 views
Any good products that could crypt the files stored in laptops? [closed]
Thefts of laptops have become very common at my place, and losses
of sensitive information is a a major concern for my businesses.
So I wonder if there is any good products out there that could crypt ...
3
votes
1answer
96 views
Can we use a public key scheme for performing cryptographic commitment
Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
3
votes
3answers
172 views
Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
2
votes
1answer
167 views
White-Box Cryptography Questions and References
I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on.
As far as I can tell, WBC has ...
2
votes
1answer
455 views
Clarification on how rainbow tables work
If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm
for "Key in Hex" enter
00000000000000000000000000000056
for "Plaintext in Hex" enter
00000000000000000000000000000000
and click on ...
1
vote
1answer
72 views
Implementing a commitment scheme in java
Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated.
Thanks
5
votes
1answer
103 views
Trusted Timestamping Scope and Real-World Uses
What security assurances does Trusted Timestamping based on Cryotography provide?
What are the real-world uses of Trusted Timestamping?
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
125 views
Detecting end-state of decryption process with unknown key
Note: this question arises purely from a theoretical interest in security research.
Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While ...
15
votes
6answers
632 views
Principle of asymmetric algorithm in plain english
I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
5
votes
1answer
181 views
Most efficient key algorithm for a TLS server key?
Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator.
Which key algorithm should I choose for the server key in ...
0
votes
0answers
113 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
7
votes
3answers
290 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
1
vote
1answer
102 views
Kerberos ticket lifetime
I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
10
votes
1answer
871 views
TrueCrypt, Master password possible?
I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have.
Now, from what I know about how TrueCrypt ...
0
votes
0answers
327 views
ideas for cryptography projects [closed]
For my nerwork security class we have to do a project on something Cryptography related. I've been pretty blank in terms for ideas so far, and I was wondering if anyone has any recommendations or ...
2
votes
2answers
301 views
Key Exchange using PKI
I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl
openssl req -x509 -nodes ...
2
votes
1answer
254 views
What would be the scenario if P = NP for RSA algorithm?
Suppose I am using RSA for my security system. Now someone discovers find a polynomial time algorithm for RSA. Then what measure should one that such that RSA never breaks. Maybe large number of used ...
4
votes
2answers
725 views
When using symmetric key encryption, do we need to sign?
Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
1
vote
2answers
172 views
Determine encoding/hashing methods used based on knowing the input and output only?
If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing ...
6
votes
1answer
149 views
Identifying, analyzing, and predicting weak session cookies
To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
0
votes
0answers
85 views
Cryptophane not working after format [closed]
Cross-posted to SuperUser
I am using Cryptophane as a Windows front end for GPG.
I used it before, and all was well, until I formatted my computer - I am now trying to restore my key database.
...
9
votes
2answers
550 views
In the recent DKIM vulnerability, how did someone determine key length by looking at headers?
Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions.
How can one determine the key length that is being used simply by looking at the headers ?
And I'm assuming ...
-4
votes
2answers
214 views
How do I construct a rainbow table to crack a 6 character password? [closed]
Given the hash:
491c290affbf5436f0fc0584ccefb2
how do I construct a rainbow table to crack this password?
8
votes
2answers
597 views
Are there really functioning quantum computers?
I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
5
votes
3answers
349 views
A safe license System
So I'm trying to think of a good way to check if the license key a user supplies for a program is legit or not.
Let's suppose this is the way they get there license
They make some type of purchase.
...
2
votes
3answers
350 views
rsa encrypted hash == rsa signature
$ echo -n "1327943823" > test_ok.txt
$ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt
$ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm
...
2
votes
1answer
100 views
Seeding GPG keygen with a hashed secret [duplicate]
Possible Duplicate:
Tool for public key cryptography where password is the private key?
I was wondering if you guys could clue me in to potential problems with using a hashed password as ...
6
votes
3answers
207 views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
0
votes
2answers
81 views
How to initiate the learning process of modern day IT Security concepts mainly cryptography? [closed]
I am a programmer with about 7 years of experience mainly in Java . I am interested in the subject of cryptography very much . I love algorithms and datastructures . When I first started learning ...
2
votes
2answers
254 views
Revoked certificate validation using past times
I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past.
Unfortunately I have problems verifying revoked ...
3
votes
2answers
278 views
Block cipher Implementation in C++
I'm writing an implementation of a block cipher in C++. I would like to study differential cryptanalysis of the cipher, so I'm generating random plaintexts and keys and then encrypt them.
Which is ...
1
vote
0answers
131 views
Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]
I have installed openssl and now the rsa_test.c is running fine. What I want to do is:
Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey.
The public key contains the ...
1
vote
0answers
46 views
Do the popular smartphone operating system have a cryptographically secure random source? [duplicate]
Possible Duplicate:
Do mobile OS’s provide crypto-quality randomness?
Linux and Mac OS X has /dev/urandom, Windows has CryptGenRandom.
Do iOS and Android have a similar way to generate ...
0
votes
0answers
60 views
how to program my own TOKEN using atmega64 [closed]
I'm trying to create a sample security token with Atmega64, And now i'm a little confused about how to program that. As it mentioned in PKCS11 Document token hardware should support about 70 function.
...
5
votes
1answer
162 views
security issue on storing keys and certificate on token
I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
3
votes
2answers
189 views
Distributed XAdES-X and XAdES-A signatures over multiple documents
As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
1
vote
4answers
891 views
What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase
(Note: originally posted in SO - advised to post on SSE)
With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...
-5
votes
3answers
369 views
create a variants of MD5
I have also asked similar q here :
To create a variants of MD5, I made following changes :
MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32)
Instead ...
0
votes
2answers
348 views
encryption method against man in the middle attack
Let's say there are 3 computers: Alice, Bob, Carol. Carol is network provider, so everything from Alice to Bob and vice versa passes through Carol. Carol can modify messages between Alice and Bob. Is ...
2
votes
2answers
599 views
Should we start using SHA-3? [duplicate]
Possible Duplicate:
What is SHA-3 and why did we change it?
SHA-3 has been finalized! So, what does secuirty.se think about the new hash funciton? Should we start replacing all uses of ...
3
votes
2answers
479 views
Using Elliptic Curve Cryptography
I am wondering if ECC could be used the way that the data is encrypted with the public key instead of the random generated key.
Is there any advantage doing that comparing to the "traditional" way of ...
7
votes
4answers
461 views
Tool for public key cryptography where password is the private key?
Is there any free & open source tool for public key cryptography, where the private key is just a chosen password?
Here is what I need:
I want to make backups every hour using a script
I want ...
