Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
1answer
138 views

AES + CBC to encrypt individual local files, fixed IV?

I am using AES and CBC to encrypt a local files separately. I don't plan to transmit them over any network. What are the risks of using a fixed IV for my encrypting application? The only problem I ...
5
votes
2answers
4k views

Decrypt cipher texts encypted with the same one time pad key

I have two pieces of ciphertext encrypted with a stream cipher using the same key. How do I recover the plaintext of both ciphertext messages without knowing the key used?
0
votes
1answer
262 views

What are the performance and security tradeoffs when selecting “ECC” or “Subgroup” in a U-Prove token?

In one of the U-Prove documents, I remember reading something that compared Subgroups versus ECC and it went something like this (paraphrased): Subgroups Requires a bigger key to achieve equivalent ...
2
votes
0answers
56 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
60 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
1answer
272 views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
1
vote
0answers
73 views

Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
4
votes
2answers
98 views

How to be sure content was generated on a specific software?

I am developing an open source software. This software generates content that is sent to a server for publishing. Anyone can get this software and generate content. The API for publishing at the ...
8
votes
1answer
322 views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...
6
votes
3answers
2k views

When changing a PGP passphrase, does it only affect the private key?

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
1
vote
2answers
197 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
6
votes
2answers
197 views

Encrypting an empty database field versus leaving it empty

In a system where personal information stored in a database is encrypted, but one of the fields only contains data in a minority of cases, would it make more sense to leave the field empty, rather ...
2
votes
1answer
75 views

Is it safe to derive an IV partially from the secret data if it is hashed before use?

To help ensure uniqueness of IV's used in a CFB AES-256 cipher, software I know of gathers bits from various sources including the plaintext being enciphered, and runs that through an SHA-256 hash. ...
0
votes
1answer
187 views

Should I run my password through Bcrypt before using it for encrypting a file with AES-256? [duplicate]

I need to encrypt a file with a password that can be memorized. So I was thinking about running the password through some rounds of Bcrypt before using it for AES encryption, so every time I want to ...
2
votes
3answers
114 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
12
votes
3answers
889 views

Multi-tenancy, SSL Certificates, and Subject Alternative Name

The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension. From the spec: The subject alternative name ...
-2
votes
3answers
149 views

How often is cryptography cracked in a pentest? [closed]

I'm a newcomer to cryptography and was wondering how often systems are attacked by cracking cryptographic systems in the real world. Is it practical to study cryptography as a hacker?
26
votes
2answers
1k views

Criteria for Selecting an HSM

A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course. As an alternative to developing a ...
5
votes
2answers
233 views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
2
votes
1answer
251 views

AES in CTR mode with same random IV to create same ciphertext

I am currently working on a little project. I am trying to generate an AES key with that I would like to encrypt a private RSA key. I have to do it this way. However, I do not want to save the AES ...
2
votes
2answers
1k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
5
votes
1answer
314 views

Known plaintext; What cipher is being used here? [closed]

plaintext: CANDY VERY CRANBERRY ciphertext: TXOtWjYhVk 8&O$4AmSA plaintext: http ciphertext: cZf. plaintext: http ciphertext: r5Hz This is definitely somehow decodable from ...
7
votes
2answers
335 views

Backup schedule for Encryption Keys

How often should encryption keys be backed up? Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often. Perhaps ...
2
votes
2answers
151 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
24
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
16
votes
2answers
939 views

Homomorphic encryption used for e-voting?

I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused: "The homomorphic property of various cryptosystems can be used to create secure voting systems, ..." ...
8
votes
4answers
5k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
9
votes
2answers
463 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
3
votes
1answer
422 views

Recognizing PGP-encrypted disks

I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS. I am interested to know how an encrypted partition/disk/file with a particular ...
7
votes
2answers
784 views

Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words, Bit manipulation instructions are useful for compressed database, hashing , large ...
2
votes
1answer
171 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
3
votes
1answer
99 views

Windows Phone and Hardcoding Values

Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
1
vote
1answer
104 views

SSL Communication and Proxy

Let us say that I have a client and a server communicating using SSL. If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
0
votes
1answer
285 views

What is a man in the middle attack?

My university provided me with the following slide which is confusing me: From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
1
vote
1answer
1k views

Symmetric Key Cryptography vs Public Key Cryptography [duplicate]

I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
73 views

Determine the Identity of Caller

Let me explain my situation. I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-6
votes
1answer
3k views

Asymmetric encryption algorithms [closed]

What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
10
votes
2answers
314 views

What are the practical uses of large asymmetric keys?

The Windows CNG supports keys of varying sizes, e.g. RSA up to 16384 bits: http://msdn.microsoft.com/en-us/library/windows/desktop/bb204778(v=vs.85).aspx. My understanding is that in crypto today we ...
3
votes
1answer
113 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
121 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
2
votes
1answer
223 views

Hash extension(padding) attack

I recently came across this website talking about sha1 padding attack. http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/ After reading here are some of my doubts: How ...
2
votes
1answer
162 views

Security Certificates - Tools to Generate Security Certificates

I want to create a self-signed certificate that will be installed as a trusted certificate authority. I then want to create another two certificates which are signed using the private key of the ...
3
votes
1answer
243 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
1
vote
1answer
2k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
3
votes
4answers
314 views

Is it possible to configure any of wifi protocols so that the network is undetectable?

I am wondering if it possible to configure my DD-WRT router so that the wifi network I am using is undetectable - impossible to tell if there is any network broadcasting even if there are clients ...
4
votes
1answer
167 views

Switching to new encryption method (without losing data?)

Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
4
votes
3answers
226 views

What SSL options should not be used?

What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
1
vote
1answer
243 views

Cryptography Online Education [closed]

Do the security experts at IT Security have a preference between the two cryptography courses offered by Coursera (Stanford), "Cryptography I" and Udacity, "Applied Cryptography"? I am seeking an ...
3
votes
1answer
158 views

3DES with fixed-encoded random key

I need an advice. I have a communication protocol using 3DES cipher. Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server ...
4
votes
4answers
824 views

Why do you need message authentication in addition to encryption?

I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states: Authenticated encryption is a form of encryption that, in addition to providing confidentiality ...