Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms (1)

2
votes
1answer
345 views

Bypass SSL Certificate Pinning using SSL Vulnerablilities

I am wondering if it could be possible to sort of "bypass" the certificate pinning protection of Android or iOS using for example the POODLE SSL vulnerability. According to this blog Entry it is ...
-6
votes
1answer
154 views

Base64 Decoding [closed]

00CDu000000000000000000000000000006e0QW00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001W00000000000000000000000000000000000000000 ...
0
votes
2answers
677 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
2
votes
2answers
158 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
-1
votes
1answer
86 views

Double encryption vs single encryption

So I understand that double encryption would do no more than possibly double the time taken to break a single encryption, as the key size of double encryption would be 2k-bits and the size of single ...
0
votes
1answer
61 views

Padding in CBC mode

Hi I have just started learning about ciphers and padding, and just wanted to know why is padding needed in CBC mode encryption, is it to get the blocks to all be of the same n-bit length? And why is ...
1
vote
2answers
119 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
1answer
148 views

AES_GCM and TLS sequence number

Am I right about that AEAD encryption/decryption uses a TLS sequence number twice, first time in the nonce and a second in additional data? And why did they make the TLS 1.2 sequence number 2 times ...
6
votes
1answer
176 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
3
votes
1answer
143 views

Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
3
votes
2answers
210 views

How to 'pair' a client/server application securely?

Please forgive me if my question is a rephrasing of a common problem, but I am not sure what to search for! My use-case is a client-server program. The server runs on a user's PC and the client runs ...
9
votes
2answers
778 views

How the NSA can break trillions of encrypted Web and VPN connections

Based on Diffie-Hellman's negotiation of key exchange, why would it turn out that only a few primes are commonly used? What and who determines the prime? Would it not be safer to use a safe prime? (...
2
votes
1answer
31 views

Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string

I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution. Here is the problem: www.domain-a.com is a secure website dealing with customer ...
2
votes
0answers
116 views

Deciphering “easy” ciphers without hints [closed]

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic encryption/...
3
votes
1answer
162 views

LibTomCrypt weird ECC Keys

I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography. In my first little program I created an ...
0
votes
1answer
199 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return (...
3
votes
2answers
215 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
2
votes
2answers
330 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-3
votes
1answer
55 views

What are the implications of differences in confidentiality timeliness?

From a security standpoint, what are the differences that must be addressed between data with a day-long confidentiality timeliness and data with timeliness of a year or more?
0
votes
1answer
70 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
2
votes
1answer
66 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
1
vote
0answers
121 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
5
votes
0answers
146 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
5
votes
1answer
545 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
3
votes
1answer
210 views

IV Reverse AES-256-CBC PKCS#7

I'm a freshmen in cryptography and want to know more about IV reversing. There's a lot of posts about finding the passphrase with a new IV. But what about the other situation? This is for educational ...
-3
votes
1answer
49 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
4
votes
1answer
158 views

What is a simple example of a trap door function?

I was attempting to explain public key cryptography to a layman the other day which requires an explanation of a trap door function. While I do know in principle what a trap door function is, I have ...
1
vote
0answers
48 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
0answers
18 views

Is the crypto-key pair in IPv6 SeND persistent?

IPv6 introduces the NDP extension SeND to help mitigate identity theft, however, is the non-PKI public/private key pair used during the process persistent to some degree, or generated on every ...
2
votes
1answer
376 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
1
vote
2answers
150 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
-2
votes
1answer
165 views

What are all the security “services” that can be applied to traffic?

I'm not sure if "services" is the correct word. But I mean to ask, what are all the possible ways of adding security to traffic. For instance, to prevent eavesdroppers from hearing your traffic, you ...
3
votes
0answers
75 views

Securely encrypt drive, able to be decrypted independently of the OS [closed]

I need a software to encrypt drives like USB pens, disc drives, ... to securely store the data. But most of the software I've found to encrypt and decrypt drives is OS dependent. For example Windows ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
0
votes
1answer
945 views

I want to encrypt my SSD, should I still use TrueCrypt or Is there a better open source alternative? [duplicate]

Before anything I have say that I have no experience with cryptography, at all. Anyway, I have a laptop with Windows 10 and an SSD. I don't want to use BitLocker since I don't trust Microsoft in this ...
-2
votes
1answer
111 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...
4
votes
1answer
192 views

What are the benefits and risks of various TLS Handshake protocols?

This question asks if it's possible to separate the rest of a TLS session from the handshake for "security reasons". The question wasn't specific on what that "reason" might be. This made me ...
1
vote
1answer
96 views

RSA signature on TLS

In a TLS handshake using ECDHE-RSA, the ServerKeyExchange frame must include the ECDHE ServerPublicKey, signed with its RSA private key, as specified in the RFC 4492. Got it. Trying to implement an ...
2
votes
1answer
366 views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
0
votes
1answer
227 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
2
votes
3answers
557 views

Implications of hashing to UTF-8 in a cryptographic function

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible ...
4
votes
2answers
758 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
7
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [closed]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
3
votes
2answers
255 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
5
votes
1answer
91 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
33
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
2answers
96 views

Building an anonymous network

Imagine you're building Facebook, except you don't want to reveal user identity for posts and comments. You still want to verify each user's organization. For example, if the user signs up with john@...
0
votes
1answer
422 views

breaking down RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

So Java has a mode called RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING. What does that even mean? RFC3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, section 7....
-1
votes
1answer
141 views

Why not create your own encryption? [duplicate]

I am wondering if AES-128 and the likes were once broken and if they were broken because people knew they were trying to break AES then why don't we create our own personal algorithm to encrypt the ...