Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

1
vote
1answer
111 views

Reasonable computationally lightweight security?

I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible. What if the ...
22
votes
7answers
825 views

At what level of abstraction should a developer work with with regards to cryptography?

I have recently came across an old blog post by Jeff Atwood which got me thinking. What could be easier than a EncryptStringForBrowser() method which has security and tamper-resistance built in, ...
3
votes
0answers
64 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
2
votes
3answers
1k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
3
votes
2answers
698 views

What hardware technology (GPU, FPGA) is fastest at generating RSA keys?

I'm interested in generating RSA keys in rapid succession and am looking for the correct hardware to so. I think what I'm looking for is very similar to a brute force attack on RSA keys, but my ...
151
votes
8answers
63k views

Why not use larger cipher keys?

RSA Security commonly uses keys of sizes 1024-bit, 2048-bit or even 3072-bit. And most Symmetric algorithms only between 112-bit and 256-bit. I do realize that the current keys are secure enough for ...
4
votes
3answers
470 views

Impact of Quantum Computers, other than new algorithms

When large scale quantum computers come along, algorithms based off of the new principles will have an impact on how we encrypt data, with Shor's algorithm rendering RSA vulnerable and Grover's ...
16
votes
5answers
995 views

Rainbow table concept for Prime numbers

Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
0
votes
1answer
708 views

ECDH is better than plain RSA? [closed]

RSALabs recommend using at least 4096 bit long RSA keys to encrypt emails but we have some performance difficulty with 4096 RSA. my noob question is what is ECDH (i didn't understood from wikipedia ...
7
votes
3answers
268 views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
1
vote
4answers
324 views

RSA and encrypted authentication

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication ...
1
vote
1answer
162 views

Secure Encrypted Chat Protocol [duplicate]

Possible Duplicate: Is there a way to negotiate a secret between 2 parties with no prior knowledge? Imagine two clients who want to establish a secure connection over a server. Both clients ...
2
votes
3answers
173 views

Given a large enough sampling of public keys could one begin to identify a private key?

For example, an ISP or government capable of tracking millions of keys being exchanged. Would that provide a sample large enough to be able to identify the private key on either end?
4
votes
3answers
339 views

Two step encryption

Consider the following user case: I have some sensitive data (eg: credit card number) I encrypt this data and store it in the database Now I want to send this data to a user X, but I don't want to: ...
2
votes
1answer
176 views

Design of Initialisation Vector

I understand that an IV (initialisation vector) should be both unique and unpredictable, but I have found little guidance as to which is most important. For an AES cipher I have a block size of 128 ...
66
votes
13answers
6k views

VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?

I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
-3
votes
2answers
85 views

Any good products that could crypt the files stored in laptops? [closed]

Thefts of laptops have become very common at my place, and losses of sensitive information is a a major concern for my businesses. So I wonder if there is any good products out there that could crypt ...
3
votes
1answer
144 views

Can we use a public key scheme for performing cryptographic commitment

Is it possible to use a public key scheme such as DSA as a commitment scheme? Are there any problems with doing this?
4
votes
4answers
482 views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
2
votes
1answer
227 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
2
votes
1answer
1k views

Clarification on how rainbow tables work

If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm for "Key in Hex" enter 00000000000000000000000000000056 for "Plaintext in Hex" enter 00000000000000000000000000000000 and click on ...
1
vote
1answer
137 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
5
votes
1answer
181 views

Trusted Timestamping Scope and Real-World Uses

What security assurances does Trusted Timestamping based on Cryotography provide? What are the real-world uses of Trusted Timestamping?
24
votes
5answers
2k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
240 views

Detecting end-state of decryption process with unknown key

Note: this question arises purely from a theoretical interest in security research. Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While ...
14
votes
6answers
1k views

Principle of asymmetric algorithm in plain english

I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
5
votes
1answer
269 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
9
votes
3answers
634 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
1
vote
1answer
143 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
12
votes
1answer
2k views

TrueCrypt, Master password possible?

I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have. Now, from what I know about how TrueCrypt ...
2
votes
2answers
759 views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
2
votes
1answer
578 views

What would be the scenario if P = NP for RSA algorithm?

Suppose I am using RSA for my security system. Now someone discovers find a polynomial time algorithm for RSA. Then what measure should one that such that RSA never breaks. Maybe large number of used ...
4
votes
2answers
2k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
2
votes
2answers
482 views

Determine encoding/hashing methods used based on knowing the input and output only?

If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing ...
6
votes
1answer
294 views

Identifying, analyzing, and predicting weak session cookies

To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
10
votes
2answers
679 views

In the recent DKIM vulnerability, how did someone determine key length by looking at headers?

Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions. How can one determine the key length that is being used simply by looking at the headers ? And I'm assuming ...
-4
votes
2answers
276 views

How do I construct a rainbow table to crack a 6 character password? [closed]

Given the hash: 491c290affbf5436f0fc0584ccefb2 how do I construct a rainbow table to crack this password?
9
votes
2answers
1k views

Are there really functioning quantum computers?

I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought ...
6
votes
3answers
447 views

A safe license System

So I'm trying to think of a good way to check if the license key a user supplies for a program is legit or not. Let's suppose this is the way they get there license They make some type of purchase. ...
2
votes
3answers
781 views

rsa encrypted hash == rsa signature

$ echo -n "1327943823" > test_ok.txt $ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt $ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm ...
2
votes
1answer
158 views

Seeding GPG keygen with a hashed secret [duplicate]

Possible Duplicate: Tool for public key cryptography where password is the private key? I was wondering if you guys could clue me in to potential problems with using a hashed password as ...
6
votes
3answers
272 views

How much added security do I really get with a longer key size?

Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
0
votes
1answer
100 views

How to initiate the learning process of modern day IT Security concepts mainly cryptography? [closed]

I am a programmer with about 7 years of experience mainly in Java . I am interested in the subject of cryptography very much . I love algorithms and datastructures . When I first started learning ...
2
votes
2answers
632 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
4
votes
2answers
472 views

Block cipher Implementation in C++

I'm writing an implementation of a block cipher in C++. I would like to study differential cryptanalysis of the cipher, so I'm generating random plaintexts and keys and then encrypt them. Which is ...
1
vote
0answers
169 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
1
vote
0answers
51 views

Do the popular smartphone operating system have a cryptographically secure random source? [duplicate]

Possible Duplicate: Do mobile OS’s provide crypto-quality randomness? Linux and Mac OS X has /dev/urandom, Windows has CryptGenRandom. Do iOS and Android have a similar way to generate ...
5
votes
1answer
214 views

security issue on storing keys and certificate on token

I'm creating a sample USB token with Atmega64. As I have to store both the public and private key and the certificate on my token is there any important security issue that I should worry about, ...
3
votes
2answers
357 views

Distributed XAdES-X and XAdES-A signatures over multiple documents

As the standard is not completely clear in this matter, I'm trying to found out if the XAdES standard (ETSI TS 101 903 v1.4.2) describes distributed case in which the SigAndRefsTimeStamp element or ...
1
vote
4answers
2k views

What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase

(Note: originally posted in SO - advised to post on SSE) With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...