Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
3
votes
1answer
1k views
Recommended Cipher Suites for TLS 1.0, 1.1 and 1.2
There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. ...
0
votes
1answer
366 views
Is Data Object on openPGP smartcard v2 encrypted?
currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard.
I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
6
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
2
votes
3answers
157 views
Closed Port security
I have what I think is a security IT question (I'm more of a programmer myself).
Assuming I am running a dedicated machine (say a PC) for a single program, meaning that the only port visible and open ...
1
vote
2answers
190 views
Does secure remote password verifier transmission need to happen out of band?
With relation to the necessity of a verifier being transmitted from the client to the server prior to any handshake steps, I was wondering how this is supposed to happen securely? To me this seems ...
3
votes
1answer
442 views
Bcrypt as a key derivation function?
I read a lot of entries at stack exchange about bcrypt and why it is supposed to be better than PBKDF2 in terms of password storage.
I'm asking now if bcrypt is better than PBKDF2 in terms of key ...
4
votes
2answers
275 views
Zero padding in HMAC
Section 2 of RFC 2104 defines the key used in HMAC should be padded with zero bytes up to the block length of the underlying hash algorithm.
Isn't this a potential security vulnerability since any key ...
3
votes
4answers
358 views
Base64 conversion for byte array in encryption
I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
4
votes
2answers
813 views
openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?
openssl_digest vs hash vs hash_hmac
I want to use SHA512 for storing password.
Which of the above methods are best to use? Why?
What is the difference between SALT & HMAC?
I just read ...
3
votes
2answers
1k views
HMAC key value and security
What effect would there be if you used the same value you were hashing as the Key in an HMAC?
For instance given the following example:
message: "my secret message"
nonce: ...
4
votes
1answer
415 views
X.509 algorithm identifier parameters vs. extension values
From the X.509 specs:
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
...
2
votes
1answer
415 views
Why doesn't asn1parse parse all DER encoding strings?
I have a file - crl.txt - that contains the following:
MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw=
It's from one of the extensions in a particular X.509 cert. Why ...
0
votes
1answer
655 views
Juniper SRX210, how to make port forwarding work? [closed]
I have a PC 192.168.1.151 which needs 554 and 9001 publicly available. So I used the following configuration but it does not work. Can anyone see my mistake ?
version 10.0R3.10;
system {
...
13
votes
3answers
856 views
What is a cryptographic oracle?
I came across the term "cryptographic oracle" and despite a bit of googling I was unable to come across a clear, concise definition. What is a cryptographic oracle and what does it do? Can anyone ...
4
votes
1answer
158 views
Thoughts on creating unscalable conditions to brute force even small passwords?
I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation.
Quoting from their page:
A simple password-based encryption ...
3
votes
1answer
444 views
parsing the id-ce-keyUsage extension in X.509 certs
I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows:
...
4
votes
2answers
81 views
Methods of accessing CRLs
I'm creating custom certificates with CDP Definitions with the option of configuring several methods of accessing the CRL. My options are HTTP, LDAP, and FTP. What are best practices or should I say ...
12
votes
6answers
3k views
Is AES encrypting a password with itself more secure than SHA1?
This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
2
votes
1answer
124 views
Does knowing encrypted information make it easier to find an unknown key?
I'm curious if knowing the exact content of an encrypted message or several messages makes it theoretically any easier to discover the encryption key. Does this speed up a brute force attack in any ...
2
votes
1answer
532 views
static IV and random keys using aes-256-cbc
Are there any security risks in using a static IV if I generate a new random KEY for each set of data to encrypt?
If I understand correctly what the purpose of the IV is in Cipher-block chaining mode ...
4
votes
1answer
1k views
Rainbow tables, generation and lookup, preferably using GPU
1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream?
One of the reasons I want to make my own, is that I want to use a specific ...
2
votes
3answers
200 views
Help with SSL teaching material
I am taking a course on security next month. As the concepts of SSL/TSL are bit hard. I am looking for a nice way of presenting it to my students. They are Compsci undergrads.
It would be nice to ...
5
votes
3answers
845 views
Can I use a private key as a public key and vice versa?
I have code to encrypt data using a public key and decrypt it using a private key. This is useful when a client wants to send data to a server and know that only the server can decrypt it.
But say I ...
2
votes
2answers
88 views
rsa certificate authorities
google.com's X.509 certificate issuer:
http://www.flickr.com/photos/31717414@N06/6543437881/
The certificate authorities installed in my browser:
http://www.flickr.com/photos/31717414@N06/6543437849/
...
5
votes
2answers
571 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
0
votes
1answer
250 views
Enterprise Encryption Considerations
What are the different aspects to consider for Enterprise Encryption policy?
So far the resources I have are:
https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet
...
1
vote
3answers
326 views
Best protection against a “chosen-ciphertext” attack?
What is the best protection against a "chosen-ciphertext" attack when transmitting (=streaming) secured (=crypted) data via networks using the TCP protocol?
3
votes
1answer
245 views
Validating data on RFID chip that has RSA signatures and SHA1 hash values
I have a RFID chip that has a digital signature using RSA and has data hashed using SHA1.
I would like to compare data from the chip and user input in a program but I believe in order to do that I ...
8
votes
2answers
2k views
Can the numbers on RSA SecurID tokens be predicted?
My workplace uses these SecurID tokens which provide you with a temporary password, the code will expire after a short time. I have always been fascinated by the things, because it seems as though ...
5
votes
2answers
484 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
1
vote
3answers
285 views
Three Message Authentication Protocol
I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
4
votes
5answers
2k views
SHA, RSA and the relation between them
SHA is the hashing mechanism. However, RSA is the encryption algorithm.
So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message??
...
3
votes
2answers
432 views
Statistical data about the performance of various encryption algorithms
How can I find statistical data about the performance of various encryption systems, such as RSA, DSA, ECC etc?
5
votes
2answers
203 views
System for Mutual authenticaion and confidentiality
I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
10
votes
1answer
848 views
Timing attacks on password hashes
Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used.
Now there are those that advertise using constant ...
-1
votes
3answers
1k views
Number of AES-256 operations per second on a maximized Cray XE6
How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second?
Cray states that it can be scaled to over 1 million ...
1
vote
1answer
442 views
Can Solaris' shadow hashes be created by better algorithms than the default DES-based hash?
By default, Solaris uses Traditional DES to encrypt password hashes in the shadow file.
Is there a way to harden the security by changing this default behaviour and make it to be hashed using a ...
5
votes
2answers
1k views
What algorithms are best be cracked by GPU?
What algorithms are best being attacked by a GPU powered password cracker?
For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it ...
6
votes
5answers
3k views
What does “key with length of x bits” mean?
I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
6
votes
1answer
464 views
Select a TripleDES key so that it effectively behaves as regular DES
I'm working with a smartcard (DESFire) that supports both TripleDES and DES. In the specs it is stated that both modes of operation use 16 bytes keys. When the first 8 bytes in the key are identical ...
9
votes
1answer
331 views
What role does cryptography play in anti-piracy?
As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
7
votes
4answers
2k views
What does Amazon's S3 Server-side encryption protect against?
Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of ...
7
votes
5answers
704 views
Save private messages encrypted in database
I'm not sure if this question fits better in StackOverflowSE or CryptoSE but i think this is the right place.
In an online community portal I want to save users' private messages encrypted in a ...
4
votes
3answers
466 views
PHP/JavaScript with RSA
I have a few columns in the database which should be encrypted. I'm wondering if the way I chose to make this system work is ok, and I'm looking forward to hear some opinions:
I chose RSA algorithm ...
5
votes
2answers
209 views
Do any crypto libraries take advantage of Windows GPU API “Direct Compute”?
Are there any encryption (decryption?) libraries that take advantage of the Windows GPU API?
13
votes
4answers
2k views
How quickly can these password schemes really be beaten?
If you use a quick hashing algorithm like MD5 or SHA-1 to hash passwords and you don't use any salt at all, how quickly could one expect a hacker to find my password out?
If I use a truly random salt ...
2
votes
3answers
1k views
RSA 4096 with AES 256 Encryption Process Using PyCrypto
I have the following process for encrypting and decrypting data in a python script using the PyCrypto module:
Encryption - Server A
AES 256 shared key is generated
Associated IV is generated
Data ...
12
votes
2answers
2k views
Which SSL/TLS ciphers can be considered secure?
The OpenSSL website provides a long list of different ciphers available for SSL and TLS.
My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
5
votes
2answers
3k views
Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?
We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
2
votes
4answers
93 views
Securely signing a container package
I have a desktop application that uses a kind of package format to load a blob and do something with it. To ensure the authenticity of the blob, I would like to add a digital signature. I researched ...
