Tag Info

New answers tagged

0

You can use Linphone to place secure calls. It supports: HD Audio and video call Secure communications (TLS, SRTP, zRTP) You would need to use a SIP service that supports authenticating and transporting traffic through TLS (not all do), like Linphone SIP service or Ostel. For detailed instructions on how to set up secure calls with Linphone see: ...


1

A common attack is to check hashes against common passwords. In that case your solution would add only one more round of decryption: choose a common password (for example "password123") decrypt the salt with the chosen password hash the chosen password with the decrypted salt Therefore you're only making attacks slower and introduce more complexity to ...


1

Your scheme is not secure as you're sending the private key of the server over the wire (in your first step). Extension (after update of question) The scheme is still not secure as now I can intercept the public key from the server and replace it with my own certificate (Man-in-the-Middle-Attack). To secure your scheme you have to use a CA (even you can ...


0

In asking this question, you're actually asking the pros of cons of using a private chain trust or one that is already available on the client. Use a public CA - PROs Since the root of the trust is assumed to be already installed on the client device the "hard" part of certificate distribution (which is, design a safe mechanism to distribute the root of ...


0

A certification agency only provides trust, not encryption. Regardless of whether you use a certificate signed by a CA or a self signed certificate, the encryption/hashing implementation is entirely down to you. Trust is important. How can I be certain that anything I download on your website is actually coming from you and not someone else? This is ...


0

Relying on a certification agency does not take you any control over cryptography (apart from some dubios agencies generating the keys for you). For getting a certification from an agency, you locally create your own keys, create a certification request (CSR) for the public key and send the public key together with the CSR to the agency. The agency has no ...


0

"Is this secure enough?" This depends on who you're defending against. In theory, it looks like it'll stand up to non-TLA attackers reasonably well, although decrypting might be a bit tricky, as you don't seem to be storing the encryption IV anywhere. In practice, it's got a major security hole. No real-world user is going to memorize the KDF iteration ...


0

Here is a link to a bash script that increases the GnuPG key size limit beyond 4096 bits. The page also provides an ideal GnuPG .conf file. https://gist.github.com/anonymous/3d928a0bcbb3ed92c454 https://tinyurl.com/ultgpgset Please provide input and recommended changes. Ultimate-GPG-Settings


3

First, start by reading the answer to this question-> https://crypto.stackexchange.com/questions/18311/how-does-a-rolling-code-work This answers your first two questions. Also, the transmitter does not periodically send an RF signal, as what starts the authentication conversation is a key fob, not the car. The only way to break out of the sequence would be ...


0

In addition to the reasons others have given already: Additional work required to set up HTTPS on the server The server administrator needs to purchase and renew certificates for each domain. The process of installing a certificate is time-consuming as for obvious security reasons you can't simply re-use the same certificate or just generate one yourself, ...


1

Encryption only provides confidentiality. Authentication only can ensure integrity as it prevents illegal modification of data. Encryption + authentication offers both confidentiality and integrity. Now the question comes why confidentiality alone is not enough or integrity alone is not enough. Encryption is usually done in various modes such as ECB, CBC, ...


1

I can think of a few benefits of authenticated encryption at the link layer over pure authenticity: Enforces confidentiality on any traffic you might have forgotten to use application-level crypto on, e.g. database connections. An additional level of hardening against replay attacks (harder to select target packets) Hides sensitive information in ...


0

Not very familiar with how a server would be able to hide a global pepper constant but my take is that sooner or later a hacker that has penetrated the server will figure out how to capture the pepper value. To make a pepper value totally secure would require special hardware. One way to do this would be to use a FPGA board installed in the server. The ...


0

Export from JKS to PKCS #12. keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12 -srcalias <jkskeyalias> -deststorepass <password> -destkeypass <password> Export certificate. openssl pkcs12 -in keystore.p12 -nokeys -out cert.pem Export unencrypted private key. openssl pkcs12 -in ...


0

"The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system." Bruce Schneier, 2009. A fingerprint reader without the guard watching it is nothing like as secure. Second, your browser plugin is unproven proprietary software of which the most you can ...


0

NO absolutely not , information security bases on mathematics in the cryptography side yes , but there still a so much bigger world in the security when mathematics is not used , and as Polynomial mentioned examples ,cryptography is just a small part in the security world , but an important one .


9

As the commenters have mentioned, information security is much more than cryptography. I can think of huge swathes of the field that do not necessarily have to include cryptography, or to which cryptography isn't really part of at all: Security policy Regulatory compliance Physical security Web application security Binary application security Network ...


0

Absolutely not. Strong and good encryption is very important, and is probably a key requirement for good security, but there is so much more. Think of protocols. SSL, TLS, handshakes, how to exchange keys in a secure way. These are all examples of information security technology that is not encryption technique but uses it. Think of file ownership and file ...


1

Here is an article from Scientific American at the end of 2012 mentioning one real-world example-- 'OnTheMap' and references research into others: http://www.scientificamerican.com/article/privacy-by-the-numbers-a-new-approach-to-safeguarding-data/ "One real-world application already uses differential privacy: a Census Bureau project called OnTheMap, which ...


1

The way I look at it is that if I have an encrypted message which is a series of bytes I can decrypt this with your public key. However any series of bytes is "valid" as a result of your encryption. This means that if somebody modifies the message then I can still decrypt it, I just won't get what you originally encrypted. The person who did the tampering ...


4

If I left a locked box on your porch in the middle of the night and chained it to your door and dropped a key in the mail slot, it would be secure. Nobody else would be able to get in to it and only you would be able to open it, but you would have no way to know who left it for you. It could have been left by the Publisher's Clearing House prize guy or a ...


9

Encryption with someones public key provides confidentiality, but doesn't provide authentication or integrity. In a PKI architecture, you encrypt your message with the public key of the recipient. This proves only that you know their public key, but nothing about yourself. When their public key is indeed public, you could be anyone, including an attacker ...


33

Encryption provides confidentiality, i.e. ensures that only intended recipient will be able to decrypt the message. Signing provides authentication, i.e. allows recipient to check that message was sent by a particular sender and wasn't modified. One way to look at this in the context of PKI is like this: encryption only requires the knowledge of ...


1

The «reference browsers» are marked with an R in the table below. What results were you given there? The problem may be on some of them (IE?) not supporting those ECDHE_RSA_* ciphers.


0

Additional padding does not necessarily increase the security in this scenario. It just increases the decryption time. You are not performing any other operations on the padded input before sending it through the algorithm for encryption. If you employ a custom protocol performing additional operations on the plain text and using the aes algorithm, there ...


2

Longer padding has no disadvantages security wise and the advantage is that it leaks less information about the length of the plaintext. The only downside to more padding is the larger ciphertext size, so as long as you consider the overhead acceptable padding to a larger block size is a good choice. For example in a chat application I'd pad to multiples of ...


1

There's a security gain, and it is just what you mentioned. If an attacker knows that the different lenghts of cyphertext mean something, he doesn't need to decrypt the message. The most extreme (textbook) situation is when you have N messages, and each has a different length. If the attacker knows what each of those message mean, he can deduct the type ...


1

No, new versions of TLS have not removed cipher suites defined in older versions.1 Which version of TLS you use and which cipher suite you use are two linked but separate matters (you can't always use a new cipher suite in an old TLS version). OpenSSL is just listing which version the cipher suites were first added in. The PRF is mostly used for key ...


-2

You can only encrypt with the public key and only decrypt with the private key. So, no, you can't decrypt e-mails with an e-mail address or the senders public key. This would completely defeat the purpose of public key crypto.


2

So I think I have a complete grasp on the question, and IBE. I'm going to attempt an answer. There is an end to my madness. IBE is based on bilinear pairings in cryptography. Page 23 of that paper is where they start talking about pairings, but I think the whole paper is relevant. A pairing scheme often used by IBE is Weil Pairing (also described in ...


0

All IBM HSMs allow development of custom firmware that can be loaded and executed in the HSM with the same level of security as the standard IBM firmware - in other words, the complete security provided by the HSM. The custom firmware can either be developed as an add-on to the standard IBM firmware, so that you get all of the standard HSM commands PLUS ...


1

Forward Secrecy The key used to protect transmission of data must not be used to derive any additional keys, and if the key used to protect transmission of data is derived from some other keying material, then that material must not be used to derive any more keys. In this way, compromise of a single key permits access only to data protected by that ...


1

Each session means each SSL session. An SSL session can be reused over multiple TCP connections (that is SSL connections) if both client and server implement session reuse and each of the SSL connections gets closed in a clean way. A SSL connection might also consist of multiple SSL sessions if you do multiple full SSL handshakes within the same connection. ...



Top 50 recent answers are included