Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
1answer
189 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
1
vote
1answer
44 views

«Secret ballot» requirement for a distributed e-voting system

There are lots of discussions about electronic voting vs paper-based voting and technical concerns about it. So here's another one. There are some concepts that are very similar to cryptocurrencies ...
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
4
votes
4answers
163 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
1answer
120 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
8
votes
1answer
215 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
7
votes
3answers
1k views

Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?

Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications. I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt as I know, if ...
2
votes
3answers
63 views

Stacking Encryptions (Stream over Block)

I am reviewing the code for a product our team developed where credit card information is stored in a local database in the event of no internet connection and came across the encryption methods. The ...
-1
votes
1answer
38 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
1
vote
1answer
88 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
1
vote
2answers
168 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
3
votes
3answers
81 views

Decrypt SSL Connections established by a Host I have adminsitrative privileges on

I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted ...
2
votes
1answer
97 views

Security risks of symmetric encryption with compression for database data

I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface. Various ...
1
vote
1answer
299 views

Bypass SSL Certificate Pinning using SSL Vulnerablilities

I am wondering if it could be possible to sort of "bypass" the certificate pinning protection of Android or iOS using for example the POODLE SSL vulnerability. According to this blog Entry it is ...
-6
votes
1answer
143 views

Base64 Decoding [closed]

00CDu000000000000000000000000000006e0QW00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001W00000000000000000000000000000000000000000 ...
0
votes
2answers
668 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
2
votes
2answers
145 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
-1
votes
1answer
84 views

Double encryption vs single encryption

So I understand that double encryption would do no more than possibly double the time taken to break a single encryption, as the key size of double encryption would be 2k-bits and the size of single ...
0
votes
1answer
51 views

Padding in CBC mode

Hi I have just started learning about ciphers and padding, and just wanted to know why is padding needed in CBC mode encryption, is it to get the blocks to all be of the same n-bit length? And why is ...
1
vote
2answers
108 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
1answer
114 views

AES_GCM and TLS sequence number

Am I right about that AEAD encryption/decryption uses a TLS sequence number twice, first time in the nonce and a second in additional data? And why did they make the TLS 1.2 sequence number 2 times ...
6
votes
1answer
161 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
3
votes
1answer
130 views

Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
3
votes
2answers
169 views

How to 'pair' a client/server application securely?

Please forgive me if my question is a rephrasing of a common problem, but I am not sure what to search for! My use-case is a client-server program. The server runs on a user's PC and the client runs ...
9
votes
2answers
745 views

How the NSA can break trillions of encrypted Web and VPN connections

Based on Diffie-Hellman's negotiation of key exchange, why would it turn out that only a few primes are commonly used? What and who determines the prime? Would it not be safer to use a safe prime? ...
2
votes
1answer
31 views

Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string

I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution. Here is the problem: www.domain-a.com is a secure website dealing with customer ...
2
votes
0answers
114 views

Deciphering “easy” ciphers without hints [closed]

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic ...
3
votes
1answer
131 views

LibTomCrypt weird ECC Keys

I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography. In my first little program I created an ...
0
votes
1answer
192 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
3
votes
2answers
185 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
0
votes
2answers
244 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-3
votes
1answer
48 views

What are the implications of differences in confidentiality timeliness?

From a security standpoint, what are the differences that must be addressed between data with a day-long confidentiality timeliness and data with timeliness of a year or more?
0
votes
1answer
66 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
2
votes
1answer
64 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
1
vote
0answers
116 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
4
votes
0answers
134 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
5
votes
1answer
524 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
3
votes
1answer
185 views

IV Reverse AES-256-CBC PKCS#7

I'm a freshmen in cryptography and want to know more about IV reversing. There's a lot of posts about finding the passphrase with a new IV. But what about the other situation? This is for educational ...
-3
votes
1answer
48 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
3
votes
1answer
141 views

What is a simple example of a trap door function?

I was attempting to explain public key cryptography to a layman the other day which requires an explanation of a trap door function. While I do know in principle what a trap door function is, I have ...
1
vote
0answers
46 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
0answers
18 views

Is the crypto-key pair in IPv6 SeND persistent?

IPv6 introduces the NDP extension SeND to help mitigate identity theft, however, is the non-PKI public/private key pair used during the process persistent to some degree, or generated on every ...
2
votes
1answer
319 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the ...
0
votes
2answers
139 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
-2
votes
1answer
159 views

What are all the security “services” that can be applied to traffic?

I'm not sure if "services" is the correct word. But I mean to ask, what are all the possible ways of adding security to traffic. For instance, to prevent eavesdroppers from hearing your traffic, you ...
3
votes
0answers
73 views

Securely encrypt drive, able to be decrypted independently of the OS [closed]

I need a software to encrypt drives like USB pens, disc drives, ... to securely store the data. But most of the software I've found to encrypt and decrypt drives is OS dependent. For example Windows ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
0
votes
1answer
817 views

I want to encrypt my SSD, should I still use TrueCrypt or Is there a better open source alternative? [duplicate]

Before anything I have say that I have no experience with cryptography, at all. Anyway, I have a laptop with Windows 10 and an SSD. I don't want to use BitLocker since I don't trust Microsoft in this ...
-2
votes
1answer
96 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...