Tag Info

Hot answers tagged

49

The SIM card contains a private key or more commonly a symmetric key called the "Ki", and the card is designed to never divulge this key to the outside world. The SIM card itself has physical security measures to make reading the key from the card very difficult without destroying the original card and/or the data stored in the card. For a long time, this ...


6

This attack is not about generating a modified SHA-1 that makes collisions easier, it's about generating a modified SHA-1 as part of the process of generating one specific collision. The modified hash function so produced is only useful for creating the single collision used in the generation process; it is no more vulnerable to collisions in general than ...


4

Since you generate the user-specific keys, you can also keep a copy of these keys somewhere (somewhere safe, preferably) and use them when needed. Alternatively, you can generate the keys with a cryptographic derivation system which uses a "superkey" and the user's identity. For instance, consider the following: The superkey is K. A user is identified ...


4

The main "problem" that ECC tries to fix is that RSA is RSA. Namely, people want to have a backup kind of algorithms, in case RSA gets brutally broken through a stupendous (and unpredictable) advance in integer factorization techniques. Integer factorization has been heavily studied for more than 2500 years (it was already all the rage in the Neo-Babylonian ...


4

(Disclosure, I work at Braintree) If a server is providing a form that customers will enter credit card numbers into then that server falls within PCI scope. This is regardless of if you encrypt the data in the browser. The reasoning here is that an attacker can modify the page that is sent to the browser to siphon credit card data out of the page DOM ...


3

Well, if you are doing plain old single DES, it doesn't matter -- 56-bit DES keys can be easily brute forced. The EFF DES cracker could break a 56-bit DES key in under a day way back in 1999. Generally, yes its best to have a totally random key for symmetric encryption (block ciphers) as there will be no shortcuts when brute-forcing the key. In practice, ...


3

Advisories recommend 2048 for now. Security experts are projecting that 2048 bits will be sufficient for commercial use until around the year 2030. The main downside to using a large cert, such as 3072 or 4096, is that the algorithm is slightly slower (still fractions of a second, though). Current browsers should all support certs upto 4096. Some CAs ...


3

There is no such thing as a one-dimensional scale of security which would allow to rate all or even most scenarios as low, medium or high security. Every scenario has context, requirements, goals, and overall an attack model. In any case, Shamir's Secret Sharing is "perfect", in that it is one of the very few algorithms which offer unconditional security: ...


3

I assume your question is: Can an attacker find pass15 more easily if they know both hasha and hashb than if they know only hashb? If that hash function is truly good it should have a good uniformity. That means that any input given to the function will be mapped to an output irrespective of how similar input is mapped. This means that knowing how ...


3

It seems to me a cryptographic hash, such as the SHA family, would do what you are describing. If not perhaps you could clarify your question.


2

Point compression does not lose information; that's the point. Technical details: suppose we are working in field Zp for a big prime p. The curve equation is: Y2 = X3 + aX + b for two constants a and b which define the curve. For a point (X,Y) on the curve, you can use the equation to recover Y2 from X alone. Since we are working in a field, Y2 can have ...


2

The core of GCM is CTR: successive values of a counter are encrypted with AES (each value is represented over a 16-byte block), thus generating a key-dependent pseudorandom stream. Actually encryption (and decryption as well) is done by XORing that stream with the data to encrypt. The XOR is done bit by bit and can be stopped at any length without any need ...


2

First thing to do is define what you mean by "secure and authenticate". You need to put into words who the attackers are, what they can do, and what they should be prevented from doing. On example of such an attack model is the following: Attackers are outsiders. They eavesdrop on the common channel (the radio waves). They want to obtain the confidential ...


2

The "ValiCert Class 2 Policy Validation Authority" root from 1999, along with about a dozen other roots from ValiCert and other CAs, are being phased out because they're only 1024 bits. 1024-bit RSA is increasingly close to being breakable1, so the community has decided to get rid of them in an orderly manner by 20112 to prevent a major security incident and ...


1

SRP is one of the large collection of algorithms which operate in a cyclic group. A cyclic group consists in elements 1, g, g2_, g3_,... up to some value gr-1 where r is the group order (the smallest non-zero integer such that gr = 1). So g is "static" because it actually is part of the definition of the playground: SRP operates in the cyclic group generated ...


1

Jasypt's StrongPasswordEncryptor is a special case of Jasypt's StandardStringDigester that, despite its name, is not standard at all. From the description, it appears to be some custom construction, which thus has the same problem than any other non-standard construction: it has not been reviewed. We don't know how to design secure functions, and the best we ...


1

Randomness really is: what the attacker does not know. Therefore, encryption keys are precisely a thing where a lot of randomness is needed. We usually talk of entropy in the following model: The key is generated with a process which involves computations (code) and random inputs (harvested from physical elements). The attacker is supposed to have perfect ...


1

Ok here is a good one that is not commonly mentioned as a digital signature security risk. There is a technique called blind signature. Which usually used for anonymous authentication like in anonymous P2P network, electronic voting, digital cash, etc. Now, if the system use the same private key for regular digital signature and for blind digital ...


1

Taken from research!rsc: "Last week, Debian announced that in September 2006 they accidentally broke the OpenSSL pseudo-random number generator while trying to silence a Valgrind warning. One effect this had is that the ssh-keygen program installed on recent Debian systems (and Debian-derived systems like Ubuntu) could only generate 32,767 different ...


1

I think this question is opinionated, but here's my take. SHA-1 is standardized. The constants used are described in RFC3174. That article describes modifying the constants of a SHA-1 implementation to induce collisions. Now your question, were the constants in RFC3174 chosen in a way that NSA could produce collisions? You could ask this same question ...


1

I cannot say if this method was used anywhere. That is probably hard to find out. However, it is not possible to use this technique to exploit already existing implementations of SHA-1 that have not been designed to be weak by purpose. SHA-1 is still safe to use (as safe as it was before). The paper you refer to only shows how, by using certain constants, ...


1

It all depends on where the RNG is being used. A good post with links to good reads. Encryption: IV Generation Encryption is effected because the entire point of an Initialization Vector is to provide more randomness into the crypt context without rekeying. Encryption: Key Generation I feel like this should be obvious, if your key is predictable in any ...


1

The plugin gets the fingerprint from the scanner and encrypts it using a randomly generated 256 AES key and then encrypts this AES using the authentication server public key. Yeah... the big question is.... Where are you storing the server private key ? If its on a HSM then great. If not, then there's a nice weak link....


1

Bitdefender is doing here a Man-in-the-Middle attack, except that it is not really an "attack" since you actually consent to it. Bitdefender impersonates you when it talks to the server, and impersonates the server when it talks to your browser. This requires Bitdefender to create on-the-fly a fake certificate for the target server; your browser is fooled by ...


1

To make a random, unbiased shuffle, you apply the Fisher-Yates algorithm. If you want to shuffle an array x of n elements (numbered from 0 to n-1), you do this: for all i from 0 to n-1 let j = rnd(n - i) + i swap x[i] with x[j] where rnd(k) means: generate a random uniform value in the 0 to k-1 range. Note that it may happen that i = j in the loop ...


1

If you're storing the card data on your own servers, even if it's encrypted and you don't have the key to decrypt it, then you need to comply with the most elaborate version of the PCI standards and use SAQ-D. I would suggest that you don't store the card data at all, but get the merchant to store it for you. Then you should only need to use SAQ-C.


1

There are many 3rd party payment processors that allow you to transparently use their forms and processing - including paypal, google, worldpay, and many others. This can be pretty much transparent to the user if configured correctly. This is the best way of side-stepping the PCI requirements - never process any of the card information... There are some ...


1

PRG do not really map something small to something big. Seed and numbers are often of the same size. Also they are not unpredictable but deterministic for a given seed. Only the sequence of numbers the PRG creates is "random". Anyway, if you need a function where you put in something big and get a smaller result where you can not simply revert the process, ...


1

This would be trivial to attack if the code actually did what you intended and it was decryptable. (It doesn't though). You have to try all 63 (length of your alphabet) different values of the hashes modulo the alphabet size and then you can decrypt any message. Essentially you shift each character by Hp+1 modulo 63, where H is the computed hash value. ...


1

Tom gave a good answer for your other question, so I will address the last one. Would you have any qualms with using ECC to encrypt sensitive material? Yes, I would have qualms about using RSA or even ECC to encrypt sensitive material in today's world. RSA relies on the integer factorization problem and ECC relies on the discrete logarithm problem. ...



Only top voted, non community-wiki answers of a minimum length are eligible