Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

3
votes
2answers
279 views

Encrypting USB traffic: Is RSA necessary for AES session key exchange when using pre-installed secret keys?

I need a solution to encrypt USB communication between device A and device B. I was thinking about configuring each device with a secret RSA-2048 key, which would be used to exchange an AES-256 ...
20
votes
1answer
626 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
6
votes
1answer
76 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
3
votes
1answer
92 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
2
votes
1answer
61 views

Can TPM Storage Keys be Created Outside TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
2
votes
1answer
396 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
1
vote
1answer
55 views

Does WebCrypto also mandate the crypto algorithms be implemented in Javascript?

I am trying to understand what WebCrypto means. From what I understand it is - A Javascript Crypto API spec that all browsers must (hopefully) support. Am I correct? If so are the crypto algorithms ...
1
vote
1answer
59 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
1
vote
1answer
17 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
1
vote
1answer
61 views

Which stream ciphers are supported in am335x cryptographic accelerator?

I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I ...
1
vote
1answer
135 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
0
votes
1answer
212 views

Prevent CryptoLocker on Server

A quick question, which may have a not-so-quick answer - Are there any ways to prevent files associated with CryptoLocker, to be propagated to a data server, by means of a back up? We use Cobian as ...
-1
votes
1answer
176 views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function ...
-1
votes
1answer
35 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
4
votes
0answers
54 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
3
votes
0answers
85 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
2
votes
0answers
30 views

Reference Implementation for Shoup's ECIES?

ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some ...
2
votes
0answers
66 views

Offering a privacy scenario with PHP mcrypt library

first of all, sorry if my question is not clear, because English is not my first language. Anyway, let-me explain the concept I'm struggling to solve as the best solution. I have some guys, and they ...
2
votes
0answers
124 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
2
votes
0answers
119 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
2
votes
0answers
62 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
102 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
0answers
37 views

Can this text be figured out?

It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised. I wonder if in this scenario is it ...
1
vote
0answers
17 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
1
vote
0answers
16 views

Checklist for Data Communication Review in ERP Solution

I am looking out for a checklist for data communication review within ERP application. I understand some of the checks would be related to digital signature, TLS/SSL use, Key Life Cycle management ...
1
vote
0answers
82 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
1
vote
0answers
91 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
1
vote
0answers
54 views

Public keys Quality

Is there any way to test the quality of generated keys from a public key cryptosystem? I've read about the common RSA attacks, but attacking the algorithm may not mean checking if the generated keys ...
1
vote
0answers
32 views

Key management for hosting applications

We're looking to host a number of client applications in our environment. Some of those will use crypto, e.g. for ssl or database encryption and obviously we'll need to manage keys for that. I am ...
1
vote
0answers
204 views

RSA 4096 key size difference - “sig” and “sig 3”

Whenever I generate a new 4096 RSA key in my GPG program and export the public key to a text file, I get a text file containing a total of around 52 lines (it varies, one of them is 53 lines). ...
1
vote
0answers
41 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
0answers
745 views

OpenSSL: Bad Record MAC on TLS Heart Beat

I am trying to see the heartbleed bug in action with my OpenSSL server application. My server uses the OpenSSL library - openssl-1.0.1b I successfully connect with s_client (openssl-1.0.1b) to my ...
1
vote
0answers
185 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
183 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
1
vote
0answers
55 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
1
vote
0answers
124 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
1
vote
0answers
60 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
1
vote
0answers
360 views

Configure Asterisk for lan with SRTP enabled SipDroid

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
0
votes
0answers
43 views

Is there an encryption scheme that allows an auditor to view some, not all data?

I want to create an online chat room allows for privacy, freedom of speech, and for law enforcement to protect citizens from violent behavior. I think the best approach is to use Shamir secret ...
0
votes
0answers
95 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
0
votes
0answers
46 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
0
votes
0answers
30 views

TLS fallback when only one protocol is enabled

Consider I have IE with ONLY TLS 1.2 enabled. TLS 1.0 and 1.1 are disabled. (And SSLv2,v3) I have a server that only supports TLS1.2, with 1.0 and 1.1 disabled as well. Assuming they share a ...
0
votes
0answers
117 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
0
votes
0answers
146 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
0answers
75 views

Suggestion of encrypt method for short fixed size result

I'm searching for a encrypt method that receives an int variable and outputs exactly 11 hexadecimal digits. I'm starting on a existing application, that already has a database of more than 130.000 ...
0
votes
0answers
24 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
0
votes
0answers
98 views

How does Spideroak manage encryption keys

I'm trying to understand the following from SpiderOak's engineering page (sorry I'm on a mobile phone so have no access to formatting functions like quote blocks): "SpiderOak uses a nested series of ...
0
votes
0answers
108 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
0answers
92 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...