Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
2answers
214 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-3
votes
1answer
47 views

What are the implications of differences in confidentiality timeliness?

From a security standpoint, what are the differences that must be addressed between data with a day-long confidentiality timeliness and data with timeliness of a year or more?
0
votes
1answer
63 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
2
votes
1answer
63 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
1
vote
0answers
114 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
4
votes
0answers
131 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
5
votes
1answer
519 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
3
votes
1answer
179 views

IV Reverse AES-256-CBC PKCS#7

I'm a freshmen in cryptography and want to know more about IV reversing. There's a lot of posts about finding the passphrase with a new IV. But what about the other situation? This is for educational ...
-3
votes
1answer
48 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
3
votes
1answer
135 views

What is a simple example of a trap door function?

I was attempting to explain public key cryptography to a layman the other day which requires an explanation of a trap door function. While I do know in principle what a trap door function is, I have ...
1
vote
0answers
45 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
0answers
18 views

Is the crypto-key pair in IPv6 SeND persistent?

IPv6 introduces the NDP extension SeND to help mitigate identity theft, however, is the non-PKI public/private key pair used during the process persistent to some degree, or generated on every ...
2
votes
1answer
291 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the ...
0
votes
2answers
129 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
-2
votes
1answer
158 views

What are all the security “services” that can be applied to traffic?

I'm not sure if "services" is the correct word. But I mean to ask, what are all the possible ways of adding security to traffic. For instance, to prevent eavesdroppers from hearing your traffic, you ...
3
votes
0answers
72 views

Securely encrypt drive, able to be decrypted independently of the OS [closed]

I need a software to encrypt drives like USB pens, disc drives, ... to securely store the data. But most of the software I've found to encrypt and decrypt drives is OS dependent. For example Windows ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
0
votes
1answer
760 views

I want to encrypt my SSD, should I still use TrueCrypt or Is there a better open source alternative? [duplicate]

Before anything I have say that I have no experience with cryptography, at all. Anyway, I have a laptop with Windows 10 and an SSD. I don't want to use BitLocker since I don't trust Microsoft in this ...
-2
votes
1answer
91 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...
4
votes
1answer
160 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
1
vote
1answer
69 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
2
votes
1answer
247 views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
0
votes
1answer
174 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
2
votes
3answers
489 views

Implications of hashing to UTF-8 in a cryptographic function

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible ...
4
votes
2answers
550 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
7
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
3
votes
2answers
226 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
5
votes
1answer
91 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
33
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
2answers
92 views

Building an anonymous network

Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with ...
0
votes
1answer
373 views

breaking down RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

So Java has a mode called RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING. What does that even mean? RFC3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, section ...
-1
votes
1answer
132 views

Why not create your own encryption? [duplicate]

I am wondering if AES-128 and the likes were once broken and if they were broken because people knew they were trying to break AES then why don't we create our own personal algorithm to encrypt the ...
0
votes
0answers
92 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
1
vote
0answers
285 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
2
votes
0answers
39 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
2
votes
1answer
272 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
1
vote
3answers
61 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
1
vote
0answers
113 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
3
votes
1answer
168 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
3
votes
2answers
1k views

How do session keys in public key cryptography work? [duplicate]

I have read that a session key is symmetric, and it is encrypted by recipient's public key; When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an ...
6
votes
2answers
183 views

Is RSA useless when my app is fully decompiled?

I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#. After I compiled whole game into .apk, I ...
3
votes
2answers
133 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
2
votes
1answer
195 views

GnuPG - Problems with large RSA keys

I have read that GnuPG limits the size of RSA keys to 4096-bits because this could lead to problems with running out of secure memory. But in which operation is this the case? Generating the keys? ...
2
votes
1answer
147 views

What is the most secure way to digitally communicate between the U.S. and China?

What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)? Updated: Here's some additional info: The ...
0
votes
1answer
1k views

Secure Client-Initiated Renegotiation - DoS DANGER

I tested my server against cryptographic attacks and I have a few major and minor issues. However I would like to know how can I mitigate and protect against such vulnerability warning: Secure ...
2
votes
0answers
91 views

A fledgling idea: Relational Encryption [closed]

I've been spending my spare time coming up with the basis for an encryption algorithm. I am completely unfamiliar with computer programming, but my time as a Network Technician left me incredibly ...
-2
votes
5answers
880 views

Asymmetric encryption: Is it possible to share private key and hide public key?

I know that normally it's the public key to be shared and the private key to be kept secret (hence the names) in asymmetric encryption. I have a special case that I want to encrypt some files and let ...
1
vote
0answers
85 views

How would an improved “read receipt” work as an email, Facebook post, or webpage?

I'm exploring various ways to implement cryptographic read receipts, that would be used to tell the content producer that the content was viewed. In addition to feedback reporting, a response might ...
3
votes
2answers
236 views

Am I encrypting and storing an array of user-details correctly?

I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have ...
2
votes
1answer
207 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...