Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

0
votes
3answers
98 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
2
votes
1answer
84 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
2
votes
1answer
148 views

adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate ...
1
vote
1answer
62 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
1
vote
1answer
173 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
1
vote
1answer
167 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
0
votes
1answer
34 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
1answer
97 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
58 views

Securing a Shuffle Algorithm

After reading about writing a secure shuffle algorithm, I realized that my module that generates a password is only as strong as my PRNG, which in this case is Math.random(). I'm confused as to how to ...
3
votes
0answers
2k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
2
votes
0answers
70 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
2
votes
0answers
58 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
75 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
0answers
101 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
44 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
1
vote
0answers
71 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
1
vote
0answers
63 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
1
vote
0answers
51 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
1
vote
0answers
218 views

Configure Asterisk for lan with SRTP enabled SipDroid

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
0
votes
0answers
17 views

Mobile App Processing Debit Card Transactions

I am creating a mobile app for iPhone and Android and the respective API that will be exposed to support the operations. This operations will require the customer to type the PIN to complete the ...
0
votes
0answers
37 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
0
votes
0answers
20 views

How does OTR's authentication using “Question and answer” protect against MiTM?

I've read that the answer has something to do Socialist Millionaire, but I still don't understand how can the user be protected against malicious Man In The Middle, which would capture the question ...
0
votes
0answers
54 views

Asymmetric vs Symmetric Encryption Benchmarks

I have found these benchmarks in Crypto++'s site. http://www.cryptopp.com/benchmarks.html But I am, quite honestly, not entirely sure how to interpret them. I am really looking for a set of ...
0
votes
0answers
199 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...