Tag Info

Hot answers tagged

30

I heard this example during one of the guest lectures back in my grad school. I think it is simple enough since I've myself used it many times, to explain ZKP to people with almost Zero Knowledge of crypto/math. Let's say that I want to convince you that I have a superpower to count the exact number of leaves on a tree, within a few seconds. I want to ...


9

Yes, multiple layers of encryption using different algorithms and different keys make the encryption as hard as the hardest in the chain. IIRC this was adressed in Bruce Schneier's book Applied Cryptography (2nd edition). But the important part is to use different algorithms, or at least different keys. Algorithms that use "round keys" are often optimized ...


6

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption capabilities. It ...


6

For cryptanalysis, the usual three-point method applies: Write down the problem. Think real hard. Write down the answer. And that's about all that can be said generically. The methodology of a cryptanalyst is about the same as that of researchers in any other science. The core of the daily work of a cryptographer is to read, read, read all the papers. ...


6

Usually, symmetric encryption starts with a random initialization vector (IV). OpenPGP uses a slightly different cypher feedback mode with an all-zero IV, but the first two blocks are random. Because of this, also the symmetric encryption is not deterministic; you cannot compare the plain text by comparing the encrypted message, the encrypted result is not ...


5

In addition to the encryption initialization vector (IV), the symmetric key derivation uses a random salt to protect against offline dictionary or rainbow table attacks. Specifically, the Iterated and Salted S2K (String-to-Key) packet contains an 8-byte salt.


5

Single, unpadded input chars That implementation you linked operates on individual characters. So patterns are repeated. Also these characters are not padded in any way. Padding would prevent such easily spotted patterns. Not the real thing So this is somewhat RSA like. But it is not actual RSA. (Because PKCS#1 mandates padding.) Wikipedia calls this ...


5

TLS_FALLBACK_SCSV fails to protect against Logjam for the same reason that Logjam actually works. That anti-fallback mechanism relies on the client putting it in the ClientHello, and being ultimately part of the input to the hash function that computes the final Finished message. This works only as long as the active attacker cannot break the handshake ...


4

1: Use hardware tokens, like a Yubikey configured for challenge-response based authentication. Or smartcards. You load up the key on them all and hand them out. They're designed to keep the secrets secret. 2: Stop using a single key, start using one keypair per user for accountability and practical revocability.


4

What you describe (figuring out which cipher was used, given only the ciphertext) is a type of distinguishing attack. Modern ciphers are generally highly resistant to such attacks: the ideal cipher produces output that is indistinguishable from random noise.


4

If the attacker knows the encryption method, then assuming it's a decent algorithm it won't help them break the cipher in any meaningful way. Cryptography is designed and analyzed under the assumption that the attacker knows everything except the key; among other reasons, it's incredibly hard to keep the attacker from knowing the system, while a key is much ...


4

It depends what you're worried about, and what you are really trying to protect. If each of these slices is individually important (say a 1 MB list of credit cards), then you're basically just encrypting each chunk by itself. The total strength of protection for each chunk is just the size of the key you used for that chunk (modulo strength/weakness of the ...


3

The best demonstration of zero-knowledge proofs I have come across is "Applied Kid Cryptography, or How to Convince Your Children You Are Not Cheating" by Moni Naor, Yael Naor, and Omer Reingold. They examine a simple but real-life cryptographic problem: how to convince people that you know the solution to a Where's Waldo puzzle without releaving any ...


3

The good answer is this story: The notable case is the “Ali Baba’s cave” metaphor used to illustrate the basic mechanisms behind a zero-knowledge proof: the prover must convince the verifier about his/her knowledge via an interactive protocol, but at the same time a casual onlooker must not gain any information about the secret knowledge. From the book: ...


3

The "padding oracle" attack you are talking about is better known as Bleichenbacher's attack against RSA. The attacker sends malformed encrypted keys; some will still (by pure chance) happen to decrypt properly, albeit with a decrypted content that the attacker cannot know. If the server's behaviour changes, depending on whether the decryption failed ("bad ...


3

Nope. Cryptowall encrypts all your data using AES, with a randomly generated key. That key is encrypted with an RSA public key, for which the bot controller holds the private key. When you pay the ransom, they decrypt the AES key using their private RSA key, which allows them to decrypt all your files. This particular type of malware is particularly ...


3

In general, for penetration testing, you must have acute and precise notions of how computers work. You must basically understand how things go "under the hood". For instance, you do not need to be a god of assembly programming, but you must have some notion of how, conceptually, a buffer overflow can result in hostile hijack of your server from remote ...


3

You must not do this. AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to produce ciphertext. Using the same key and IV produces the same ...


2

That's not quite what happens. As public/private key encryption is more expensive than symmetric encryption, its use is minimal. During the SSL handshake, the client and server agree upon a shared symmetric key that they use for bulk encryption. The remainder of the communication then occurs using this symmetric key. This symmetric key is then rotated on a ...


2

You can use the MD5 cryptography hash without any serious concern but why not consider using the public key to confirm the private key in question. You could have the partner sign a sample binary and use the public key to confirm the signature and thereby confirm the private key. If you want to work outside the signing infrastructure you could use a ...


2

WARNING: Creativity ahead, which is often bad for security (at least without thorough review). This sounds like a case in which an SSH agent could be useful. An SSH agent provides a socket interface over which SSH clients can ask the agent to perform key operations for them, which enables the following common uses: You can have the long-running agent ...


2

I don't think this should be an issue - using a single key pair to access many servers is perfectly fine and most of the world works that way. Its important to understand, as @Tom Leek mentioned, that the private part of the key - which must stay secret - is only stored on your single machine and is never transfered out of it. So even if one of the servers ...


2

In some cases it might actually compromise the security of it. http://www.di.ens.fr/~fouque/pub/crypto07b.pdf HMAC-MD5 has a key recovery attack in the upper end of achievable but impractical, although attacks only get better over time.


2

Some things to consider when dealing with TLS as a protocol. The payload of the communicating packet is encrypted. The 'dst' & 'src' packet attributes are not, which allows for any device within the network route to intercept your communication. Numerous attack against the SSL & TLS protocol over the years have allowed for the following attack ...


2

Approaching your second question, rather than using a different crypto algorithm, you can replace gpg in symmetric mode with openssl: echo "plain text" | openssl enc -aes-128-cbc -nosalt -pass pass:secret Beware: For sample purposes, I am providing the passphrase in the command line. See PASS PHRASE ARGUMENTS in openssl(1) for better ways of providing ...


2

I think you're confused because of a misunderstanding between encrypting and hashing. I'll try to clarify by quoting your original post. "When you view the configuration of the appliance it shows the key as a cipher text (imagine perhaps the idea is stop people shoulder surfing the key of the appliance). So the plain text key I entered in the appliance ...


1

You don't use a hash function to encrypt things. You use an encryption algorithm. You don't use an encryption algorithm to sign things. You use a signature algorithm. The text you quote uses to traditional explanation of signatures as "encryption with a private key", which is a very confusing way of stating things, and works only for a specific signature ...


1

It's only tangentially related, but David Aspinall (University of Edinburgh) and Mike Just (Glasgow Caledonian University) published a paper on partial passwords in 2013: "Give Me Letters 2, 3 and 6!": Partial Password Implementations & Attacks. Their paper looks at online attacks for which the backend storage mechanism is irrelevant, but it makes a ...


1

This indicates your private key is encrypted with a passphrase. pgpdump does not decrypt private keys to display them. With GnuPG 1 and 2, you can at least export unencrypted subkeys using gpg --export-options export-reset-subkey-passwd --export-secret-subkeys [key-id]. This will also print the secret x part of your key. For GnuPG 2.1, this option was ...


1

Tracking down the links referenced in the answers, I think it would be safe. Out of an abundance of caution, I will exclude the private key from the list of md5sum values I allow to be stored on computers connected to the Internet. I will then use the signatures generated for the same binary to confirm the excluded private keys are identical. Even if ...



Only top voted, non community-wiki answers of a minimum length are eligible