Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
1
vote
1answer
140 views
PGP Secret Key Values calculation
I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
3
votes
1answer
157 views
Is there a way to store user files without being able to decrypt them?
I'd want to build a secure file storage web application.
Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
3
votes
2answers
222 views
Is the password hash better when you concatenate the password and username?
Is the password hash (with bcrypt) better when You concatenate the username with password?
For example:
$this->hash($username . $password);
and
$this->hash($password);
Last time I used ...
1
vote
1answer
124 views
Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?
NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
2
votes
3answers
198 views
Establish a secure channel with mutual authentication given pre-shared public keys
Suppose I have a system whereby parties are identified by their public key (with some pre-selected asymmetric key algorithm). Suppose I have a party PUB1 which wants to establish a secure channel with ...
2
votes
1answer
96 views
Does a hash have more than one possible original message? [duplicate]
Possible Duplicate:
Collision rate for different hash algorithms
Many hashing algorithms seem to have fixed-length message digest as output.
If I compute the md5 hash of two strings:
...
1
vote
1answer
602 views
What are the consequences of disabling ssl v2 and weak ciphers?
It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack".
If the weak and vulnerable ciphers ...
1
vote
1answer
106 views
Inner Workings of Public Key Encryption
After watching this video explaining PKE with tennis balls (interesting), it left me with a few particular questions that I'm having trouble finding answers to:
I assume that they keys used to ...
2
votes
3answers
140 views
Secure device pairing protocol
I need to implement secure pairing between two devices based on a short shared PIN code with no trusted third party. If you think about the way bluetooth devices pair you won't be far off -- my ...
0
votes
1answer
217 views
any small idea to decode this algortihm from php script [closed]
So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) .
The encoded result $xId_campaign_encoded from the php script has ...
-1
votes
2answers
225 views
Request/Creating a Code Signing Certificate
I have need for a code signing certificate which is trusted by a CA in the windows domain. How do I request/create this certificate?
Do I have to request a code signing certificate on the ...
2
votes
4answers
250 views
Fingerprinting Hash Function
For the purpose of fingerprinting data with the least chance of collision will combining the length (as a 32 bit unsigned integer stored in addition to the hash) of the input data and/or sampling a ...
-4
votes
2answers
131 views
Alternative for cryptography
Is there any alternative for cryptography? I heard a lot about quantum cryptography, but is this the only stuff which have a chance to exist in the future? Are there any other kinds of cryptography?
2
votes
1answer
423 views
EMV Security? How is it possible that it's secure?
I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
4
votes
4answers
574 views
Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?
The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed.
The posts ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
1
vote
1answer
137 views
Editing images containing hidden information
Suppose we have an image with some hidden info behind it. If we open it in a photo manipulation software like Photoshop or Gimp, without editing it and just save it as a new image, does the image ...
3
votes
2answers
165 views
Securely storing (email) lookup database
Looking for suggestions on implementing a server-side lookup table, where the key is an email address.
Goal: Keep these email address private, even if data on the server is stolen.
Assumptions: The ...
1
vote
2answers
91 views
How do i use a guessable ID for authentication
This question doesn't fit well in many categories but hopefully someone's run into it before.
I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
2
votes
2answers
109 views
Security of asymmetrical decrypting proxy
I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play).
I've ...
1
vote
2answers
158 views
Using digital signatures to identify users
Consider the following requirement:
Bob should be able to verify that a payment request came from Alice.
The above is in simple terms the basic idea, however, in reality Alice would be user A of ...
2
votes
4answers
751 views
Bouncy Castle - document signed by sender and only readable by receiver?
I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
38
votes
5answers
2k views
What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?
Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
5
votes
3answers
295 views
How to verify crypto engine?
If I understand this correctly, when I use a cryptographic (hardware) engine, I have to trust it. Are there any cryptographic algorithms with properties that allow me to verify the correctness of an ...
11
votes
7answers
503 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
-1
votes
1answer
161 views
About important hacks in history [closed]
I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
3
votes
1answer
362 views
For what malicious activity can one use a computer with a high-end GPU?
I'm currently researching what malicious activities can one do with a computer containing a high-end GPU. So far the only uses I found were Bitcoin mining and password cracking. Are there any other ...
1
vote
1answer
317 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
6
votes
2answers
398 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
0
votes
1answer
327 views
PGP encryption/signature with BouncyCastle [closed]
I've implemented PGP encryption and signature using BouncyCastle on Java. It works, but all the examples I'm based on have hardcoded the algorithms for symetric encryption, hashing and compression.
...
2
votes
2answers
232 views
Is it true that encryption bit “strength”, although numerically identical, may actually be different depending on the algorithm?
I was reading recently that for AES, the encryption strength is actually the key size/length, so 128-, 192- or 256-bit. While, for SHA-2, the encryption strength is measured against the message digest ...
4
votes
3answers
162 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
-1
votes
1answer
152 views
How to find the encryption of a cipher and apply it to another key [closed]
I am very new to cryptography so please help me out with this one
I have a Question Key-1 which + some encryption gives Answer key-1. I have to find the encryption to apply it to another Question ...
1
vote
1answer
416 views
Is using the same RSA key pair for both (signing and encryption) & (signing and encryption) a bad idea? [duplicate]
Possible Duplicate:
Why should one not use the same asymmetric key for encryption as they do for signing?
I'm new to IT Security. I still can't figure out why using the same RSA key pair ...
4
votes
2answers
578 views
MAC vs Encryption
I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't?
I know that ...
2
votes
1answer
1k views
Is BCrypt enough when saving a password into a database?
In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted).
...
3
votes
2answers
414 views
Can we prevent a man-in-the-middle attack with symmetric-key cryptography?
Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and ...
1
vote
1answer
360 views
SRP 6a implementation C#
I'm trying to implement the SRP crypto; 6a. However I'm not familiar with the cryptography and it's computing. I'm using the public implementation of the BouncyCastle lib, but I have no idea how it ...
15
votes
3answers
453 views
If I have two identical linux virtual machine images, will they generate identical random numbers?
A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically?
Or maybe someone could direct me to a helpful research ...
6
votes
1answer
2k views
What is the actual value of a certificate fingerprint?
In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
0
votes
1answer
137 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
3
votes
3answers
360 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
2
votes
1answer
1k views
Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?
If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data?
If the latter, then if someone had access ...
5
votes
3answers
418 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
2
votes
2answers
279 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
4
votes
4answers
321 views
Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was:
CA with RSA keys capable of signing RSA and EC CSRs
CA with ...
3
votes
3answers
244 views
TLS Renegotiation Indication Extension vulnerability
I am trying to understand the TLS Renegotiation Indication Extension from the RFC.
I can understand that it is related to the fact that the renegotiation is send under the encrypted stream but can not ...
16
votes
5answers
9k views
Why most people use 256 bit encryption instead of 128 bit?
Isn't 128 bit security enough for most practical applications?
3
votes
1answer
539 views
how do extended validation X.509 certs work?
https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
1
vote
3answers
3k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
