Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
3 votes
1 answer
1k views

Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?

note: Title edited to make the answer more useful to a wider audience I'm reading source code for encrypting files with AES GCM and see the following binary output. AdditionalAuthData IV ...
makerofthings7's user avatar
3 votes
1 answer
665 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
user12588's user avatar
0 votes
2 answers
500 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
Curious's user avatar
3 votes
1 answer
664 views

Avoiding Replay Attacks on Lightweight Channel

I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
David's user avatar
  • 16.1k
22 votes
3 answers
3k views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
FloatingRock's user avatar
3 votes
1 answer
852 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
user50849's user avatar
  • 2,580
1 vote
3 answers
6k views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
tausif's user avatar
  • 111
24 votes
5 answers
5k views

Why are there few (none?) easy to use encryption libraries?

If I search stack overflow for how to safely encrypt data, one of the first hits is someone's custom encryption scheme. I've seen several similar questions on this site, and in general they are all ...
user50849's user avatar
  • 2,580
0 votes
1 answer
210 views

Assuming a good hash system, if 2 hashes has about 50% of their bits the same, what is the likelihood that the corresponding plaintext is the same? [closed]

I am new to cryptography and this practice question is puzzling me. Please help!
user41521's user avatar
112 votes
9 answers
80k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
Dmitri DB's user avatar
  • 1,181
0 votes
1 answer
122 views

two encrypting / hashing case, which one is best

Thinking about these below two cases, which one is best and most secure one 1st case //key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
toughcanny's user avatar
23 votes
3 answers
3k views

Can RSA keys be swapped?

On a theoretical level, is there anything inherently different about public vs private keys? During RSA key generation there are two keys generated, key A and key B. Key A is private and Key B is ...
bahamat's user avatar
  • 1,121
0 votes
2 answers
310 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
n9Beast's user avatar
  • 13
0 votes
1 answer
199 views

is this code valid for securing passwords? [duplicate]

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure $pass='test'//the password $salt=openssl_random_pseudo_bytes(...
Dev Man's user avatar
  • 113
0 votes
1 answer
220 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
robobooga's user avatar
  • 103
1 vote
3 answers
5k views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . "...
Ben Johnson mk2's user avatar
255 votes
8 answers
78k views

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
user avatar
1 vote
1 answer
2k views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
user40242's user avatar
0 votes
1 answer
179 views

Frequency Analysis [closed]

I have started looking into Crytography, and the obvious starting point is frequency analysis. As a task for myself I thought it would be good to compile a script which could be used for perform the ...
MHibbin's user avatar
  • 103
1 vote
1 answer
477 views

Root certificate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certificate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
RobinHo's user avatar
  • 135
2 votes
0 answers
46 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? [duplicate]

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
Dennis L's user avatar
  • 131
1 vote
5 answers
402 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
Dennis L's user avatar
  • 131
0 votes
1 answer
1k views

In regards to GPG4Win, what does "use NAME as default secret key"?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
user avatar
3 votes
5 answers
18k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
Mike's user avatar
  • 33
5 votes
1 answer
188 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong protocols ...
makerofthings7's user avatar
2 votes
2 answers
634 views

Using 1-day expiration GPG keys only... any disadvantages?

From the thread Does OpenPGP key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
Pacerier's user avatar
  • 3,313
1 vote
3 answers
2k views

How to hide the sensitive data from the developer of the application and the DBA of the database

I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that contains a salary field, I need the programmer of our IT center could not know the salaries of other ...
user39814's user avatar
0 votes
2 answers
592 views

Do known plaintext attacks lead to exposure of the key?

I say that if a professional code breaker has a bunch of data, the encoded version of said data and the encoding method he can figure out the encoding key. It is just a matter of having enough data. ...
user39566's user avatar
-1 votes
4 answers
2k views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
Nathan's user avatar
  • 101
0 votes
1 answer
220 views

Public Key Cryptography : Key length

While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
Sungwon Lee's user avatar
32 votes
2 answers
9k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
nealmcb's user avatar
  • 20.8k
3 votes
2 answers
2k views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable?

The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources),...
Louis Jackman's user avatar
3 votes
1 answer
132 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
Josh Wyant's user avatar
2 votes
1 answer
2k views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
firefexx's user avatar
  • 189
241 votes
6 answers
289k views

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
ilazgo's user avatar
  • 2,753
4 votes
4 answers
750 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
BahKoo's user avatar
  • 103
0 votes
1 answer
474 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
Subi's user avatar
  • 11
14 votes
1 answer
836 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
William Breathitt Gray's user avatar
1 vote
2 answers
2k views

why are the first few characters of a DSA Private Key similar?

I noticed most DSA private keys often start with the same few characters, MIIBvAIBAAKBgQD . For example, generate a private key on Ubuntu, by running: ssh-keygen -t dsa -N '' -f /tmp/id_dsa This ...
JamesThomasMoon's user avatar
14 votes
2 answers
19k views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
Shurmajee's user avatar
  • 7,457
3 votes
2 answers
1k views

Hashes of overlapping data - does it make them easier to crack even when neither is cracked

Say I have strings: stringA, StringB, stringC. And I make two hashes: HashA = sha256(stringA + stringB) HashB = sha256(stringB + stringC) For the sake of the argument I'm suggesting sha256 but ...
pacifist's user avatar
  • 814
5 votes
1 answer
19k views

How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?

According to PCI-DSS 3.4 Requirement: Render PAN unreadable anywhere it is stored by using the below methods: One-way hash Truncation Index tokens and pads Strong cryptography with associated key-...
RajeshKannan's user avatar
1 vote
3 answers
750 views

Hashed Database: Hash Functions

Let's assume there is a database containing names and each name is hashed and the clear-text is deleted. If an attacker were to steal this database, would he/she be able to get the list of names?
Sungwon Lee's user avatar
0 votes
1 answer
317 views

Cryptography - Perfect Secrecy [closed]

Assuming you have a block cipher that (when given a 128­-bit key) yields an instance of a true pseudorandom permutation... how can you use that block cipher within the above constraints to achieve ...
Sungwon Lee's user avatar
8 votes
2 answers
878 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
Lem0n's user avatar
  • 197
-7 votes
1 answer
563 views

What is the excellence of RSA vs my algorithm [closed]

I was wondering that what make RSA Asymmetric Cryptography Algorithm special. So I wrote a very simple algorithm that do the same work (Generate Public and Private Key) Now I want to ask you that What ...
Seyed Hamed Shams's user avatar
0 votes
2 answers
950 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
user37442's user avatar
1 vote
3 answers
287 views

How to guarantee privacy on files that I store

I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use. e.g. A lawyer want to upload a sentence ...
sanrodari's user avatar
  • 135
12 votes
2 answers
760 views

Forward secrecy for kids

In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers). I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...
ScoutHelper's user avatar
1 vote
2 answers
906 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
Fingolfin's user avatar
  • 175

1
29 30
31
32 33
48