Tagged Questions

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

4
votes
1answer
91 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
1
vote
1answer
199 views

What is default mode for AES encryption [closed]

What will be the default mode for AES encryption if we don't use any specific mode like ECB, CBC, OFB, CTR, etc. and just carry out the encryption without specifying any AES encryption mode.
1
vote
2answers
126 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
1answer
123 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
2
votes
1answer
206 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
3
votes
2answers
144 views

What does the “period” of a random number generator measure?

What is "period" in the context of pseudo-random number generators? For example when someone says "The Mersenne Twister has a 2^19337−1 period" what does it mean? I would appreciate a simple as ...
1
vote
2answers
104 views

What are some examples of a block cipher's versatility over a stream cipher?

I understand that a block cipher can be made to act like a stream cipher at the cost of "losing versatility" of the block cipher for the sake of performance. I don't understand what I'd be losing. ...
-1
votes
1answer
190 views

Current Encryption Algorithms? [closed]

What are some encryption algorithms that are currently in use by secure websites, by operating systems, or by Secure USB thumb drive manufacturers. I am trying to do research on differences in speed ...
-1
votes
4answers
214 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
1
vote
1answer
86 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
1
vote
1answer
82 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
2
votes
1answer
153 views

Better than brute-force way to find the “lowest” sha1 hash?

While pointing out a SQL injection flaw on another question, I was able to show that an arbitrary sha1 hash could be inserted into a query such that it would be taken for a real hash, and was ...
1
vote
0answers
47 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
2
votes
1answer
159 views

Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?

note: Title edited to make the answer more useful to a wider audience I'm reading source code for encrypting files with AES GCM and see the following binary output. AdditionalAuthData IV ...
2
votes
1answer
168 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
0
votes
2answers
107 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
2
votes
1answer
121 views

Avoiding Replay Attacks on Lightweight Channel

I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
15
votes
3answers
552 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
2
votes
1answer
284 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
1
vote
3answers
503 views

How does encryption/decryption work when one generate random key?

I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123") to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll input my ...
12
votes
4answers
737 views

Why are there few (none?) easy to use encryption libraries?

If I search stack overflow for how to safely encrypt data, one of the first hits is someone's custom encryption scheme. I've seen several similar questions on this site, and in general they are all ...
0
votes
1answer
80 views
0
votes
1answer
66 views

two encrypting / hashing case, which one is best

Thinking about these below two cases, which one is best and most secure one 1st case //key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
7
votes
3answers
223 views

Can RSA keys be swapped?

On a theoretical level, is there anything inherently different about public vs private keys? During RSA key generation there are two keys generated, key A and key B. Key A is private and Key B is ...
0
votes
2answers
145 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
102 views

is this code valid for securing passwords? [duplicate]

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure $pass='test'//the password ...
0
votes
1answer
88 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
1
vote
3answers
545 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
125
votes
8answers
11k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
0
votes
1answer
143 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
1answer
51 views

Frequency Analysis [closed]

I have started looking into Crytography, and the obvious starting point is frequency analysis. As a task for myself I thought it would be good to compile a script which could be used for perform the ...
1
vote
1answer
83 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
2
votes
0answers
38 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? [duplicate]

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
5answers
163 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
214 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
1
vote
3answers
2k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
3
votes
1answer
66 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...
1
vote
2answers
189 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
3answers
222 views

How to hide the sensitive data from the developer of the application and the DBA of the database

I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that contains a salary field, I need the programmer of our IT center could not know the salaries of other ...
0
votes
2answers
151 views

Does Known plaintext attacks lead to exposure of the key?

The back-story is long and boring so I will get down to the meat of the argument. I say that if a professional code breaker has a bunch of data, the encoded version of said data and the encoding ...
-1
votes
4answers
455 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
0
votes
1answer
86 views

Public Key Cryptography : Key length

While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
10
votes
2answers
1k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
1
vote
1answer
235 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
3
votes
1answer
47 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
0
votes
1answer
163 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
2
votes
2answers
109 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
0
votes
1answer
158 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
9
votes
1answer
195 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
1
vote
2answers
281 views

why are the first few characters of a DSA Private Key similar?

I noticed most DSA private keys often start with the same few characters, MIIBvAIBAAKBgQD . For example, generate a private key on Ubuntu, by running: ssh-keygen -t dsa -N '' -f /tmp/id_dsa This ...