Questions tagged [cryptography]
Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).
2,353
questions
3
votes
1
answer
1k
views
Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?
note: Title edited to make the answer more useful to a wider audience
I'm reading source code for encrypting files with AES GCM and see the following binary output.
AdditionalAuthData IV ...
3
votes
1
answer
665
views
Should generating gpg keys ever result in an identical key to an older key?
I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
0
votes
2
answers
500
views
If P=NP, what is still cryptographically secure? [duplicate]
I know, I know - "If P=NP" is a really large, high-impact assumption.
But this is a hypothetical.
I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
3
votes
1
answer
664
views
Avoiding Replay Attacks on Lightweight Channel
I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
22
votes
3
answers
3k
views
Storing passwords in reversible form - a genuine use-case
What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text!
I know. Hear me out.
Assume I've got a service that's similar to Mint.com. For those that ...
3
votes
1
answer
852
views
Is my AES/CTR/RIPEMD encryption correctly implemented?
Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking.
For brevity, I've inlined the functions for ...
1
vote
3
answers
6k
views
How does encryption/decryption work when one generate random key?
I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123")
to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll
input my ...
24
votes
5
answers
5k
views
Why are there few (none?) easy to use encryption libraries?
If I search stack overflow for how to safely encrypt data, one of the first hits is someone's custom encryption scheme. I've seen several similar questions on this site, and in general they are all ...
0
votes
1
answer
210
views
Assuming a good hash system, if 2 hashes has about 50% of their bits the same, what is the likelihood that the corresponding plaintext is the same? [closed]
I am new to cryptography and this practice question is puzzling me. Please help!
112
votes
9
answers
80k
views
Why can we still crack snapchat photos in 12 lines of Ruby?
Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
0
votes
1
answer
122
views
two encrypting / hashing case, which one is best
Thinking about these below two cases, which one is best and most secure one
1st case
//key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
23
votes
3
answers
3k
views
Can RSA keys be swapped?
On a theoretical level, is there anything inherently different about public vs private keys?
During RSA key generation there are two keys generated, key A and key B. Key A is private and Key B is ...
0
votes
2
answers
310
views
What is truly unbreakable these days? [closed]
Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1
answer
199
views
is this code valid for securing passwords? [duplicate]
i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure
$pass='test'//the password
$salt=openssl_random_pseudo_bytes(...
0
votes
1
answer
220
views
Theoretical key encryption question
I have a question regarding encryption and message sending.
There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI).
It is known that when A wants to send a message ...
1
vote
3
answers
5k
views
What is the correct way to make a password salt?
I've made the below function to make a completely random 64 character long hash
function password_salt($password){
$salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . "...
255
votes
8
answers
78k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
1
vote
1
answer
2k
views
Is it possible to insert data into UUID?
Is it possible to insert arbitrary data into UUID?
Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
1
answer
179
views
Frequency Analysis [closed]
I have started looking into Crytography, and the obvious starting point is frequency analysis. As a task for myself I thought it would be good to compile a script which could be used for perform the ...
1
vote
1
answer
477
views
Root certificate from an CA company which can be encrpyted by SoftHSM
Does anybody know a CA company which allows me to put the bought CA certificate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)?
Is it hard to work with the PKCS11 ...
2
votes
0
answers
46
views
Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? [duplicate]
Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
1
vote
5
answers
402
views
Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?
Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1
answer
1k
views
In regards to GPG4Win, what does "use NAME as default secret key"?
1- what does "use NAME as default secret key" do in Kleopatra tool options?
The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
3
votes
5
answers
18k
views
inquiry about SHA1 with RSA for certificate signature
As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
5
votes
1
answer
188
views
Are there any fast Homomorphic Obfuscuation techniques available?
Assuming that cryptography falls into one of three areas:
Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources
Cryptographically strong protocols ...
2
votes
2
answers
634
views
Using 1-day expiration GPG keys only... any disadvantages?
From the thread Does OpenPGP key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
1
vote
3
answers
2k
views
How to hide the sensitive data from the developer of the application and the DBA of the database
I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that contains a salary field, I need the programmer of our IT center could not know the salaries of other ...
0
votes
2
answers
592
views
Do known plaintext attacks lead to exposure of the key?
I say that if a professional code breaker has a bunch of data, the encoded version of said data and the encoding method he can figure out the encoding key. It is just a matter of having enough data. ...
-1
votes
4
answers
2k
views
Secure communication between server and client [duplicate]
I'm writing some security software, and don't want anyone to be able
to intercept data as its passed from client->server, and server->client.
The best way to do this is over HTTPS via SSL. However, ...
0
votes
1
answer
220
views
Public Key Cryptography : Key length
While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
32
votes
2
answers
9k
views
Describe an example of indistinguishability obfuscation or functional encryption
As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013:
Candidate Indistinguishability Obfuscation and Functional ...
3
votes
2
answers
2k
views
Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable?
The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources),...
3
votes
1
answer
132
views
Storing original length of encrypted message
Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
2
votes
1
answer
2k
views
Implementation language for crypto
I'm going to implement a small crypto lib/tool.
The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;)
So the first step is the ...
241
votes
6
answers
289k
views
Is Telegram secure?
There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption.
But they store all the messages in their servers and WhatsApp ...
4
votes
4
answers
750
views
How do clients enroll using SRP?
From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
0
votes
1
answer
474
views
RSA vs ECDSA for VANET Security
I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
14
votes
1
answer
836
views
Securing a prediction about a future event
I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome.
For example, suppose Alice predicts that ...
1
vote
2
answers
2k
views
why are the first few characters of a DSA Private Key similar?
I noticed most DSA private keys often start with the same few characters, MIIBvAIBAAKBgQD .
For example, generate a private key on Ubuntu, by running:
ssh-keygen -t dsa -N '' -f /tmp/id_dsa
This ...
14
votes
2
answers
19k
views
Cryptography behind chip based credit cards (smart cards)?
Why are chips safer than magnetic stripes?
The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
3
votes
2
answers
1k
views
Hashes of overlapping data - does it make them easier to crack even when neither is cracked
Say I have strings: stringA, StringB, stringC.
And I make two hashes:
HashA = sha256(stringA + stringB)
HashB = sha256(stringB + stringC)
For the sake of the argument I'm suggesting sha256 but ...
5
votes
1
answer
19k
views
How to Encrypt Credit Card number for storing it in sql server database according to PCI DSS Requirement?
According to PCI-DSS 3.4 Requirement:
Render PAN unreadable anywhere it is stored by using the below methods:
One-way hash
Truncation
Index tokens and pads
Strong cryptography with associated key-...
1
vote
3
answers
750
views
Hashed Database: Hash Functions
Let's assume there is a database containing names and each name is hashed and the clear-text is deleted.
If an attacker were to steal this database, would he/she be able to get the list of names?
0
votes
1
answer
317
views
Cryptography - Perfect Secrecy [closed]
Assuming you have a block cipher that (when given a 128-bit key) yields an instance of a true pseudorandom permutation... how can you use that block cipher within the above constraints to achieve ...
8
votes
2
answers
878
views
Requiring 2 keys to access a content
I need to use an external service that can only be accessed by password.
I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do.
Considering this ...
-7
votes
1
answer
563
views
What is the excellence of RSA vs my algorithm [closed]
I was wondering that what make RSA Asymmetric Cryptography Algorithm special.
So I wrote a very simple algorithm that do the same work (Generate Public and Private Key)
Now I want to ask you that What ...
0
votes
2
answers
950
views
Is AES feasible for secure hashing files? [closed]
There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
3
answers
287
views
How to guarantee privacy on files that I store
I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use.
e.g. A lawyer want to upload a sentence ...
12
votes
2
answers
760
views
Forward secrecy for kids
In the Scouts, it is popular to use secret codes to write messages (which are simple ciphers).
I want to introduce Forward secrecy to the kids so they can use it with these ciphers. So, if the ...
1
vote
2
answers
906
views
Google's usage of RC4
I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following:
I know Google uses RC4 for most of its services, and this is the
reason one shouldn't keep ...