Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
2answers
100 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
-2
votes
1answer
156 views

What are all the security “services” that can be applied to traffic?

I'm not sure if "services" is the correct word. But I mean to ask, what are all the possible ways of adding security to traffic. For instance, to prevent eavesdroppers from hearing your traffic, you ...
3
votes
0answers
60 views

Securely encrypt drive, able to be decrypted independently of the OS [closed]

I need a software to encrypt drives like USB pens, disc drives, ... to securely store the data. But most of the software I've found to encrypt and decrypt drives is OS dependent. For example Windows ...
5
votes
1answer
100 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
0
votes
1answer
507 views

I want to encrypt my SSD, should I still use TrueCrypt or Is there a better open source alternative? [duplicate]

Before anything I have say that I have no experience with cryptography, at all. Anyway, I have a laptop with Windows 10 and an SSD. I don't want to use BitLocker since I don't trust Microsoft in this ...
-2
votes
1answer
76 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...
4
votes
1answer
124 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
1
vote
1answer
51 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
2
votes
1answer
148 views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
0
votes
1answer
150 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
2
votes
3answers
408 views

Implications of hashing to UTF-8 in a cryptographic function

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible ...
5
votes
2answers
393 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
7
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
3
votes
2answers
182 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
5
votes
1answer
89 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
1
vote
0answers
26 views

At what point is information encrypted when communicating from a C# program over HTTPS? [closed]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
31
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
0
votes
0answers
29 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
1
vote
2answers
88 views

Building an anonymous network

Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with ...
0
votes
1answer
236 views

breaking down RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

So Java has a mode called RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING. What does that even mean? RFC3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, section ...
-2
votes
1answer
114 views

Why not create your own encryption? [duplicate]

I am wondering if AES-128 and the likes were once broken and if they were broken because people knew they were trying to break AES then why don't we create our own personal algorithm to encrypt the ...
0
votes
0answers
77 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
1
vote
0answers
240 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
2
votes
0answers
39 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
0
votes
1answer
217 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
1
vote
3answers
55 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
2
votes
0answers
104 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
4
votes
1answer
108 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
2
votes
2answers
722 views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
6
votes
2answers
156 views

Is RSA useless when my app is fully decompiled?

I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#. After I compiled whole game into .apk, I ...
4
votes
3answers
126 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
3
votes
1answer
163 views

GnuPG - Problems with large RSA keys

I have read that GnuPG limits the size of RSA keys to 4096-bits because this could lead to problems with running out of secure memory. But in which operation is this the case? Generating the keys? ...
1
vote
1answer
143 views

What is the most secure way to digitally communicate between the U.S. and China?

What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)? Updated: Here's some additional info: The ...
1
vote
1answer
977 views

Secure Client-Initiated Renegotiation - DoS DANGER

I tested my server against cryptographic attacks and I have a few major and minor issues. However I would like to know how can I mitigate and protect against such vulnerability warning: Secure ...
2
votes
0answers
81 views

A fledgling idea: Relational Encryption [closed]

I've been spending my spare time coming up with the basis for an encryption algorithm. I am completely unfamiliar with computer programming, but my time as a Network Technician left me incredibly ...
-3
votes
5answers
488 views

Asymmetric encryption: Is it possible to share private key and hide public key?

I know that normally it's the public key to be shared and the private key to be kept secret (hence the names) in asymmetric encryption. I have a special case that I want to encrypt some files and let ...
1
vote
0answers
82 views

How would an improved “read receipt” work as an email, Facebook post, or webpage?

I'm exploring various ways to implement cryptographic read receipts, that would be used to tell the content producer that the content was viewed. In addition to feedback reporting, a response might ...
2
votes
1answer
206 views

Am I encrypting and storing an array of user-details correctly?

I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have ...
2
votes
1answer
157 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
0
votes
1answer
118 views

Can this text be figured out?

It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised. I wonder if in this scenario is it ...
2
votes
2answers
110 views

Checksum Calculation for Source Code tar balls downloads

Http sites like OpenSSL provide checksum for each source code tarball available for download HTTPS sites like GitHub usually do not provide checksum with 'download zip' option. Some sites although ...
1
vote
1answer
97 views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
3
votes
2answers
173 views

ECC and RSA 10K stronger claim

There are a lot of websites where it is claimed something akin to this but no explanation on the basis. "ECC key size of 256 bits is equivalent to a 3072-bit RSA key and 10,000 times stronger than a ...
5
votes
2answers
551 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
4
votes
2answers
77 views

Where in a TLS connection can I get the signature of the content sent by the server?

I want to be able to prove that a given content returned by a HTTPS server was in fact served. I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's ...
6
votes
2answers
179 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
2
votes
1answer
122 views

Are TLS session keys cached in a browser?

For example, when authenticating to a TLS protected service, and then closing the tab, you can sometimes reconnect to the service afterwards without re-authenticating. In preservation of perfect ...
1
vote
2answers
88 views

Do modern cryptographers / cryptoanalytics need the knowledge of historical cryptography

It makes a lot of sense for people to know the history of their profession from various points of view and I suppose especially in cryptography because people can still use old ciphers and no one ...
2
votes
3answers
128 views

Chaining multiple PGP keys

I would like to know the practical limitations to contact chaining multiple peoples pgp key's in order to protect a file. In normal public key cryptography, four keys are required, public and private ...
2
votes
2answers
85 views

Authenticated encryption (Symmetric encryption) for .NET applications [closed]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...