Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
1answer
64 views

Can an attacker make in-app-purchases of my products in their app?

My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle. Apple's In-App-Purchase system allows ...
2
votes
1answer
197 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
4
votes
0answers
131 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
3
votes
0answers
79 views

Is there a benefit in measuring randomness? How would it be done?

Is there any benefit in determining how random a given file, stream, signal is? I guess this would be useful to determine If something is (poorly) encrypted To verify the proper encryption of a ...
3
votes
0answers
238 views

How Does Telegram's Identity Verification Work?

Note: please refrain from commenting on Telegram's design of OTHER parts, as it will distract from the stem of the question. Background: Signal (Previously, "TextSecure" app) uses specific "Your ...
3
votes
0answers
55 views

Reference Implementation for Shoup's ECIES?

ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some ...
3
votes
0answers
157 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
2
votes
0answers
27 views

How rf remotes for “cloning” rolling code find matching codes?

I've been tinkering with a rf (garage door) remote control that has a scanner mode (google JMA SR-48 for details). This mode works for Mutancode and Erreka which I assume would be similar to KeeLoq. ...
2
votes
0answers
18 views

Is the crypto-key pair in IPv6 SeND persistent?

IPv6 introduces the NDP extension SeND to help mitigate identity theft, however, is the non-PKI public/private key pair used during the process persistent to some degree, or generated on every ...
2
votes
0answers
39 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
2
votes
0answers
209 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
2
votes
0answers
64 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
111 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
0answers
25 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
0answers
27 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
1
vote
0answers
64 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in ...
1
vote
0answers
53 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
113 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
1
vote
0answers
45 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
1
vote
0answers
282 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
113 views

OpenPGP smartcards compromised by blackhat 2015 simcard hack?

This blackhat was a new sidechannel attack in the SIM-card AES encryption announced. I am currently using the OpenPGP smart/SIM-card version 2.1 to store my PGP-private keys, which is the same model ...
1
vote
0answers
85 views

How would an improved “read receipt” work as an email, Facebook post, or webpage?

I'm exploring various ways to implement cryptographic read receipts, that would be used to tell the content producer that the content was viewed. In addition to feedback reporting, a response might ...
1
vote
0answers
44 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
1
vote
0answers
41 views

Checklist for Data Communication Review in ERP Solution

I am looking out for a checklist for data communication review within ERP application. I understand some of the checks would be related to digital signature, TLS/SSL use, Key Life Cycle management ...
1
vote
0answers
107 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
1
vote
0answers
172 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
1
vote
0answers
33 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
271 views

RSA 4096 key size difference - “sig” and “sig 3”

Whenever I generate a new 4096 RSA key in my GPG program and export the public key to a text file, I get a text file containing a total of around 52 lines (it varies, one of them is 53 lines). ...
1
vote
0answers
41 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
0answers
291 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
247 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
1
vote
0answers
61 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
1
vote
0answers
150 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
1
vote
0answers
61 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
0
votes
0answers
41 views

How does Signal Protocol, used by `whatsapp` Works?

I want to understand the process of The Signal Algorithm, I have google it, but unable to find any good Article or tutorial. I want to understand the basic definition and functionality of The signal ...
0
votes
0answers
18 views

Decrypting keys wrapped by the Storage Root Key (SRK) of a TPM

Lets say I have a symmetric key wrapped with a storage root key (SRK) in a TPM. The SRK cannot be read by an attacker and so I perform the decryption and using the SRK and get the symmetric key in ...
0
votes
0answers
27 views

Secure transfer with proxy person in the middle

I am new to cryptography, so I would like some validation. I have an unusual use case that I haven't found described anywhere and would like to get some help validating my approach. Alice needs ...
0
votes
0answers
21 views

Are there any known weaknesses in SignedXml by Microsoft for SAML?

SingedXml is a common way to verify the signature for SAML in .Net applications. I am wondering if it secure enough, i.e. there is no way to trick it (by making it verify not top-level Assertion or ...
0
votes
0answers
48 views

Digitally signing a digital signature

When might it make sense to digitally sign a digital signature?
0
votes
0answers
39 views

DSS digital signing approach

Under the DSS approach to digital signing, what is the advantage of using two pairs of keys for each signature?
0
votes
0answers
50 views

How to convert the PRIVATEKEYBLOB structure generated using CryptExportKey to bigendian?

Private-key BLOBs, type PRIVATEKEYBLOB, are used to store private keys outside a CSP. Extended provider private-key BLOBs have the following format. PUBLICKEYSTRUC publickeystruc; RSAPUBKEY ...
0
votes
0answers
91 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
0
votes
0answers
48 views

Is there an encryption scheme that allows an auditor to view some, not all data?

I want to create an online chat room allows for privacy, freedom of speech, and for law enforcement to protect citizens from violent behavior. I think the best approach is to use Shamir secret ...
0
votes
0answers
111 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
0
votes
0answers
175 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
0
votes
0answers
104 views

Suggestion of encrypt method for short fixed size result

I'm searching for a encrypt method that receives an int variable and outputs exactly 11 hexadecimal digits. I'm starting on a existing application, that already has a database of more than 130.000 ...
0
votes
0answers
161 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
0answers
129 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
0
votes
0answers
926 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
0
votes
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...