Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms (1)

3
votes
3answers
193 views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
0
votes
1answer
58 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
12
votes
2answers
418 views

How difficult it was to crack Navajo's language during WW2?

It is well known that during the WW2 America employed native American, namely Navajo people, to "encrypt" their radio communications. I read some time ago (I don't remember where) that their language ...
3
votes
1answer
126 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
-1
votes
1answer
107 views

How do I change LUKS backend to OpenSSL?

I know there is a way to do it, but I don't know how to do it: the default backend for LUKS is libgcrypt and I want to test it with the openssl cryptographic library. I was told that there is a ...
10
votes
3answers
380 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
7
votes
1answer
228 views

Encrypting individual files on OS X

I am about to go paperless, and I want to protect the documents that I scan. The use case is that I'll be scanning paper documents, encrypting each file, and storing them locally and on various backup ...
0
votes
2answers
70 views

Asymmetric Encryption for Multiple Recipients?

Let's assume an arbitrary group of people who hold a key pair and who make their public key online accessible. Let X, A, B and C be arbitrary people from that group. Now X wants to encrypt a message ...
4
votes
1answer
197 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
3
votes
2answers
103 views

How can I create a secure random key for AES?

I need to generate a lot of shared keys for an AES method which uses in various condition, my concern is how can I generate unpredictable keys? I've had some research on Cryptographically secure ...
2
votes
1answer
96 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
-1
votes
1answer
71 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
5
votes
2answers
204 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
4
votes
3answers
195 views

Strange RSA usage - how secure is it?

Is following communication scheme secure? To my mind, it uses RSA modulus and public key exponent as a cryptographic secret, which is strange usage of RSA, but can it be easily broken because of ...
-2
votes
2answers
178 views

How are people still copying and redistributing DRM-protected music

...when DRM-protected material is encrypted using the AES cipher, which there are currently no efficiently computable cracks for?
3
votes
1answer
103 views

Designing a PKI environment

For our company I was given the task to design a durable, structured PKI environment for mainly client authentication purposes. We need a Root CA with a couple of Intermediate CAs, like this: ...
0
votes
1answer
285 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
-2
votes
1answer
100 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
5
votes
1answer
109 views

How Can Malware Hide Using Cryptography

How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then ...
1
vote
0answers
28 views

Can there be two certificates with a same serial number in the world? [duplicate]

Recently I came across this odd question. I hope, Serial number is unique across certificates signed by a particular CA. So is there any chance that two different CAs sign two different certificates ...
6
votes
1answer
52 views

Terminology for attacks of extracting an application's shared library and using it stand-alone

Let say I got a library to read/write files securely on the hard disk (encrypt before writing and decrypt to read back). If the library is severely obfuscated, attackers may be intimidated. So they ...
3
votes
2answers
154 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. https://developer.mozilla....
5
votes
1answer
419 views

Is keepass random password generator fully secure and trustworthy?

Am I safe using keepass for generating passwords? For example my accounts, am I safe using a keepass generated password? Could my future keepass master-keys be safely generated in keepass? What method ...
2
votes
2answers
152 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications in-...
1
vote
0answers
64 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
1answer
119 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
94 views

Steganography concept - How to check my implementation? [closed]

I have written my own software to do Steganography. Basically, I am dividing the message (text) into bits and then hide them into pixels in jpg. After that I am saving the bitmap into .png (because ....
1
vote
2answers
340 views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
1
vote
2answers
71 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
3
votes
0answers
84 views

Is there a benefit in measuring randomness? How would it be done?

Is there any benefit in determining how random a given file, stream, signal is? I guess this would be useful to determine If something is (poorly) encrypted To verify the proper encryption of a ...
10
votes
4answers
1k views

Possible to read strength of encryption?

With the recent talks of governments trying to weaken encryption, I had a question about how they would implement it. For example, let's just say that the government banned anything above AES-128. I ...
5
votes
1answer
117 views

Resetting the Windows RNG

According to this research, Windows seems to produce the same sequence of random numbers indefinitely when a process is kicked off before a VM snapshot is taken. This is a huge issue obviously when ...
48
votes
9answers
13k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
273 views

Crack 512-bit RSA encrypted messages without a private key?

I was wondering if it would be possible to crack a message that was encrypted with 512-bit PCKS1 encryption with the public key. I am doing a project for our science fair type thing at school and have ...
3
votes
2answers
193 views

In Ephemeral Diffie Hellman Key Exchange - what is actually ephemeral?

Just starting to learn about Diffie-Hellman, and it seems simple enough, but I am struggling to find any resources that explain in an Ephemeral Diffie Hellman Key Exchange, what it is that is actually ...
1
vote
2answers
193 views

Encrypting unique fields in a Database

I'm still a beginner to cryptography and want to know what the best practice is for solving the following problem: I'm creating an application with the requirement that a user's email address must be ...
1
vote
0answers
36 views

Is there a point in cascade encryption? [duplicate]

I was reading the other day about some programs (ex: DiskCryptor), and with my limited knowledge of cryptography.. I started wondering about cascading encryptions (ex: AES-Twofish-Blowfish). Assuming ...
-1
votes
2answers
190 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
4
votes
2answers
339 views

How Does Telegram's Identity Verification Work?

Note: please refrain from commenting on Telegram's design of OTHER parts, as it will distract from the stem of the question. Background: Signal (Previously, "TextSecure" app) uses specific "Your ...
0
votes
1answer
290 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
1
vote
1answer
50 views

«Secret ballot» requirement for a distributed e-voting system

There are lots of discussions about electronic voting vs paper-based voting and technical concerns about it. So here's another one. There are some concepts that are very similar to cryptocurrencies ...
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
4
votes
4answers
167 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
1answer
132 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
10
votes
1answer
320 views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
7
votes
3answers
2k views

Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?

Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications. I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt as I know, if ...
2
votes
3answers
64 views

Stacking Encryptions (Stream over Block)

I am reviewing the code for a product our team developed where credit card information is stored in a local database in the event of no internet connection and came across the encryption methods. The ...
-1
votes
1answer
43 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
1
vote
1answer
89 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
1
vote
2answers
211 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...