Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
25
votes
4answers
2k views
Why shouldn't we roll our own?
Why shouldn't we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I'm ...
1
vote
2answers
507 views
Is there an index of all md5 collisions?
I am about to build a caching system based on md5 to generate file names out of lists of natural numbers. The inputs would be groups like: 1,18,94,100,266,1854.
I know there are some collisions in ...
3
votes
3answers
1k views
How insecure are PHP's rand functions?
There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here.
I understand those functions are insecure, but how insecure are they?
...
12
votes
4answers
284 views
Why aren't digital signatures the standard way to authenticate web clients?
The web is a mess of incompatible cookie schemes, asinine requirements ("your password must contain letters, numbers, and at least one symbol from !()-_., and must begin with a letter, and once you ...
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
6
votes
3answers
439 views
Computer decryption algorithms and knowing the solution
This is a general question about using computers to decrypt information. It has puzzled me for a while.
The question is really two parts:
How does a computer check if a "guessed" key is the correct ...
3
votes
2answers
283 views
Signing data bigger than allowed RSA Block size?
I've enountered a small problem while implementing a modified version of the
Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key:
...
1
vote
3answers
4k views
Windows 7 Password Hash Security
I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes.
I understand that these hashes are stored in the SAM ...
1
vote
3answers
678 views
How wep wireless security works?
I want to know more about how WEP (Wired Equivalent Privacy) protocol for wireless securiy. From this wikipedia article I have got a basic Idea. But I still don't get what the initialize vector is? Is ...
0
votes
1answer
165 views
Should I encrypt data on my server as an extra layer of protection?
I'm going to create a client-server application that stores a user's sensitive financial information on the server. I would like to encrypt this data so that even if a hacker gets access to the ...
4
votes
2answers
203 views
Is it possible to modify a CA without having to reissue all of the derived certificates?
Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I ...
3
votes
3answers
157 views
How to know who I am protecting database information from?
I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database.
Here are a couple articles I've read on the subject, ...
1
vote
3answers
287 views
Differences between brute forcing access versus decrypting password files or databases
I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had ...
1
vote
0answers
57 views
Using GPG or PGP for symmetric database encryption/decryption in c# [duplicate]
Possible Duplicate:
Using GPG or PGP for symmetric database encryption/decryption in c#
I am looking to symmetrically encrypt/decrypt information in a database. This info consists of short ...
1
vote
0answers
112 views
OpenPGP CFB mode examples [closed]
Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow.
I got one example from asking on ...
1
vote
1answer
147 views
PGP Secret Key Values calculation
I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
3
votes
1answer
167 views
Is there a way to store user files without being able to decrypt them?
I'd want to build a secure file storage web application.
Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
3
votes
2answers
231 views
Is the password hash better when you concatenate the password and username?
Is the password hash (with bcrypt) better when You concatenate the username with password?
For example:
$this->hash($username . $password);
and
$this->hash($password);
Last time I used ...
1
vote
1answer
129 views
Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?
NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
2
votes
3answers
209 views
Establish a secure channel with mutual authentication given pre-shared public keys
Suppose I have a system whereby parties are identified by their public key (with some pre-selected asymmetric key algorithm). Suppose I have a party PUB1 which wants to establish a secure channel with ...
2
votes
1answer
100 views
Does a hash have more than one possible original message? [duplicate]
Possible Duplicate:
Collision rate for different hash algorithms
Many hashing algorithms seem to have fixed-length message digest as output.
If I compute the md5 hash of two strings:
...
1
vote
1answer
660 views
What are the consequences of disabling ssl v2 and weak ciphers?
It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack".
If the weak and vulnerable ciphers ...
1
vote
1answer
110 views
Inner Workings of Public Key Encryption
After watching this video explaining PKE with tennis balls (interesting), it left me with a few particular questions that I'm having trouble finding answers to:
I assume that they keys used to ...
2
votes
3answers
146 views
Secure device pairing protocol
I need to implement secure pairing between two devices based on a short shared PIN code with no trusted third party. If you think about the way bluetooth devices pair you won't be far off -- my ...
0
votes
1answer
221 views
any small idea to decode this algortihm from php script [closed]
So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) .
The encoded result $xId_campaign_encoded from the php script has ...
-1
votes
2answers
232 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
2
votes
4answers
252 views
Fingerprinting Hash Function
For the purpose of fingerprinting data with the least chance of collision will combining the length (as a 32 bit unsigned integer stored in addition to the hash) of the input data and/or sampling a ...
-4
votes
2answers
135 views
Alternative for cryptography
Is there any alternative for cryptography? I heard a lot about quantum cryptography, but is this the only stuff which have a chance to exist in the future? Are there any other kinds of cryptography?
2
votes
1answer
443 views
EMV Security? How is it possible that it's secure?
I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
4
votes
4answers
618 views
Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?
The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed.
The posts ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
1
vote
1answer
138 views
Editing images containing hidden information
Suppose we have an image with some hidden info behind it. If we open it in a photo manipulation software like Photoshop or Gimp, without editing it and just save it as a new image, does the image ...
3
votes
2answers
171 views
Securely storing (email) lookup database
Looking for suggestions on implementing a server-side lookup table, where the key is an email address.
Goal: Keep these email address private, even if data on the server is stolen.
Assumptions: The ...
1
vote
2answers
92 views
How do i use a guessable ID for authentication
This question doesn't fit well in many categories but hopefully someone's run into it before.
I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
2
votes
2answers
112 views
Security of asymmetrical decrypting proxy
I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play).
I've ...
1
vote
2answers
162 views
Using digital signatures to identify users
Consider the following requirement:
Bob should be able to verify that a payment request came from Alice.
The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
2
votes
4answers
783 views
Bouncy Castle - document signed by sender and only readable by receiver?
I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
39
votes
5answers
2k views
What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?
Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
5
votes
3answers
310 views
How to verify crypto engine?
If I understand this correctly, when I use a cryptographic (hardware) engine, I have to trust it. Are there any cryptographic algorithms with properties that allow me to verify the correctness of an ...
11
votes
7answers
514 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
-1
votes
1answer
161 views
About important hacks in history [closed]
I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
3
votes
1answer
364 views
For what malicious activity can one use a computer with a high-end GPU?
I'm currently researching what malicious activities can one do with a computer containing a high-end GPU. So far the only uses I found were Bitcoin mining and password cracking. Are there any other ...
1
vote
1answer
325 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
7
votes
2answers
415 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
0
votes
1answer
335 views
PGP encryption/signature with BouncyCastle [closed]
I've implemented PGP encryption and signature using BouncyCastle on Java. It works, but all the examples I'm based on have hardcoded the algorithms for symetric encryption, hashing and compression.
...
2
votes
2answers
239 views
Is it true that encryption bit “strength”, although numerically identical, may actually be different depending on the algorithm?
I was reading recently that for AES, the encryption strength is actually the key size/length, so 128-, 192- or 256-bit. While, for SHA-2, the encryption strength is measured against the message digest ...
4
votes
3answers
167 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
-1
votes
1answer
159 views
How to find the encryption of a cipher and apply it to another key [closed]
I am very new to cryptography so please help me out with this one
I have a Question Key-1 which + some encryption gives Answer key-1. I have to find the encryption to apply it to another Question ...
1
vote
1answer
431 views
Is using the same RSA key pair for both (signing and encryption) & (signing and encryption) a bad idea? [duplicate]
Possible Duplicate:
Why should one not use the same asymmetric key for encryption as they do for signing?
I'm new to IT Security. I still can't figure out why using the same RSA key pair ...
4
votes
2answers
612 views
MAC vs Encryption
I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't?
I know that ...
