Tag Info

Hot answers tagged

48

Is Git crowdsourcing the production of SHA-1 preimages? Not to any meaningful degree. Github doesn't say how many commits it's tracking, but it's probably not more than a few billion. For comparison, there are 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976 possible SHA-1 hashes, so the odds of finding a plaintext matching an arbitrary ...


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


27

You are doing it wrong. Not in the splitting or whatever; but in the thinking. AES encryption, if done properly, won't be "cracked". AES is the most robust piece in your system; this is the last part of it that you should be worrying about. What AES encryption provides is a very specific functionality: using a given key K, it transforms a piece of data (the ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


12

Nope Generally speaking: No. Hashing is not encryption. Hashing is not reversible. At all. It always generates a fixed length output. So with an output fixed to say 32 characters, and an input of 33 characters, there is no possible way to reverse this. The information of that one character is irretrievably lost. -- And along with it all other characters. ...


12

You could probably compute your own SHA1 hashes quicker from small arbitrary texts than that you harvest the hashes that someone else computed. But there's a lot of possible SHA1 digests, like a few for each atom in the universe and still some left. That illustrates the challenge if you want to keep a list of all known digests and search that list.


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...


9

There are several reasons why this would be a sub-optimal security scheme. Here are a few: The biggest issue with secure passwords is our memory, or our limited capacity for remembering passwords. We're pushing our memory limits as it is, and always working to devise new tricks to help better remember more secure passwords. This scheme introduces new ...


8

The amount of human effort which has gone into computing each of those SHA-1 hashes found in Git is significant. And that means the number of hashes computed that way is fairly limited. If you want to find collisions, you need zero human effort per hash and very little computer time spend on each hash. Bitcoin might be the only system with enough computing ...


8

I'd like to implement some kind of simple (yet as strong as possible) encryption > for my client-server application network traffic. Data to be encrypted can be both textual, and binary. You're implementing a modified Vigenère cipher. That might be a problem in that any sufficiently large sequence of repetitive data (with binary zeroes being the most ...


7

Read Shannon's 1949 work. Understand diffusion and confusion. Then understand that you do not understand enough *YET* about set theory, probability and linear maths to know that you don't have enough background to design or implement an enciphering algorithm. Read Dunning-Kruger effect while you are at it, but please keep learning, so that some day you will ...


5

First don't roll your own crypto and read DTK answer. But, I do believe that we learn by experimenting so I will answer your questions Does there already exist a similar two-way function? Yes. They are called block cipher and come with different mode of operation. The block cipher is a function that encrypt the data for 1 particular block. In your ...


5

The number one problem with the scheme you've proposed is that you've completely ignored secure key exchange. The next problem is that the output isn't going to be anything like random as Iserni pointed out and is therefore susceptible to a number of attacks. The next problem after that is that it isn't authenticated, which can lead to ciphertext ...


4

You should be worrying about secure storage of the AES key, not about breaking up the data. If the key is compromised, it really won't make any difference what you've done with the data because Kerckhoffs's principle. Edited to add: Most especially, you must not store the AES key in the same database that holds the encrypted data because a database ...


4

A youtube video from Defcon 21: http://youtu.be/NG9Cg_vBKOg?t=6m19s The guy being investigated simply changed the extensions of the files (eg. from test.jpeg to test.txt). However when the crypto guys look at it their tool detects that the extensions don't match the files and these files are the first to be examined more closely by a human.


3

Because the entire message is not encrypted separately for each recipient. Instead, a single symmetric encryption key is chosen at random, the message is encrypted once using that key, and then the encryption key is itself encrypted separately for each recipient, using that recipient's public key, and appended to the encrypted message. Each recipient ...


3

Some vendors sell systems that work like you describe. The biggest problem is lack of active cooperation from vendors; there is no reliable way to build a list of hashes of "allowed binaries" since: What looks like "an application" from the user's point of view may be a collection of many executable files (to a large extent, that's what DLL are). Any ...


1

May I suggest that you rethink your approach to this problem. Where are you storing the data? If it's in a database most databases have the ability to encrypt data at rest fairly securely. Does the data need to move over an insecure channel? Look into the HTTPS or secure FTP. Don't mess with crypto unless you absolutely have too. It's extremely easy to ...


1

if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization using quantum annealing and at ~12:10 they can produce a D-Wave machine (maybe as an NSA special order) that can factor 2n bit number with 2n^2 qubits. First he describes that you can describe RSA as an optimization problem. But you can ...


1

If someone can steal your encrypted key, then they can read your private files: chances are they can execute code into your machine and sniff your key password (however strong). A GnuPG smartcard with an external keypad protects both the card and the password. Edit: did you try cipher-algo AES512? Addedd strength is probably superfluous, but the added ...


1

Hybrid Encryption Systems OpenPGP defines a hybrid encryption system, which combines the best of both asymmetric (public key) encryption and symmetric encryption. While asymmetric encryption is great at key management, it is very slow for encrypting large amounts of data; symmetric encryption on the other hand would require exchanging keys with everybody ...


1

Clarifications: If I understand you correctly you are interested in including the order a password is typed within the data needed to use it correctly. For example if my password is typed out in order like this: 'p' 'a' 's' 's' 'w' 'o' 'r' 'd' It would not work if someone typed 'w' 'o' 'r' 'd' and then clicked to the beginning and typed 'p' 'a' 's' 's'. ...



Only top voted, non community-wiki answers of a minimum length are eligible