New answers tagged

1

An overt channel is a communications path that is not hidden. Anyone can see that Steve connected to Stack Exchange. A covert channel is an intentional communications path that is hidden, using a technique like steganography. This might use a technique like a dead drop, where I post a picture on eBay, you view the posting on eBay, but nobody can easily ...


1

[Note: This question has been re-posted on crypto.SE.] Let's break down the problem into two parts: The first problem is that you want something that looks random to an outside attacker (ie is unpredictable), but can be computed by anybody in the know. That sounds a lot like a Cryptographically secure pseudorandom number generator (CPRNG) where all nodes ...


-1

I thought something about the XOR operation. If I'm not wrong XOR is symmetrical so if you apply a XOR k XOR k you obtain a again. So for encryption you can use just a XOR, and for the decryption you can use another XOR.


3

You have three tradeoffs: PBKDF vs another algorithm, open source vs closed, and the availability of test vectors. SCrypt or BCrypt may give you somewhat more security than PBKDF2. On the other hand, if there's an implementation failure in the code (as happened to Ashley Madison) then you get a lot less security. To the extent that the code gets ...


-2

I think your question ignores important concepts. Using your own system and depending on security of your system are two entirely different concepts. Using your own custom code as an additional layer of defense while you use industry standard code to have industry standard security as well is fine. Using you own untested, unproven code as the only line ...


2

I'm assuming here that key is something static at system level, and not something an individual user chooses - if so, it is very strange that it is read as UTF-8 rather than as Base64 because UTF-8 will be an inefficient storage mechanism for the key as it won't be using the full keyspace. I would put this down to developer naivety rather than anything done ...


5

How much can we trust open source implementations of crypto (security) libraries? Much better than closed source implementation. When it comes to security that really matters, you have to follow the principle "trust but verify". Trust that popular open source implementations are more likely to get it correct and enough eyeballs to spot mistakes, but ...


1

Never code encryption or hashing libraries yourself, but use already existing ones instead. Those already existing ones are made by people who are often specialized in it. Besides that. The best one to use should be open-source in first place. By being open-source more security-experts/people have the opportunity to find bugs or errors, and by that more ...


1

One tangible example is timing attack on string comparison. It works by measuring how much it takes for the application to compare 2 strings. The default string comparison implementations in nearly all programming languages are optimized and they work by comparing 2 strings character by character and they alert a mismatch as soon as they see a difference ...


2

FormsAuthentication.Encrypt() now uses the encrypt-the-MAC pattern over both the IV and the ciphertext, so yes, it is done correctly now. As a side note, it does depend on the machinekey element to determine which encryption and MAC algorithms are used, it's worth double-checking your configuration to ensure you're configured to use either AES or Auto ...


0

If you want to parse on Windows as well you should use keyStr.replaceAll("(-+BEGIN RSA PRIVATE KEY-+\\r?\\n|-+END RSA PRIVATE KEY-+\\r?\\n?)", ""); to substitute DER string.


3

One option: They can clone the whole system to a computer or another phone. After that, they will do the tries. After it wipes itself, they will clone it again. Second option: If it is the data what is going on, they can copy it to a PC and crack it there. No wiping applies on that in this case ...


0

Output size of RSA encryption always equivalent to RSA key size. In your case of Sha1RSA 2048 signing, 160 bit sha1 digest is padded as per PKCS#1 padding scheme in order make input block equivalent to RSA key size and then encrypted with RSA private key which results in 2048 bit signature.


2

First, SSL stopped at version 3.0, which is massively flawed. TLS is currently at 1.2 (plus a lot of activity in the TLS 1.3 working group). This is generally a matter of acronym - hopefully when you say SSL encrypted, you actually mean TLS, and you specifically mean TLS 1.2 with AEAD ciphers. Second, for TLS of any type, both protocol version and cipher ...


0

Quit working with the JQ... string. First, take the Ow... string, and work out a series of steps that result in the desired cleartext. Then apply those same steps to the JQ... string!


-1

Generate Key - 64+ Characters Email Key Hash the key using a pre-entered 4+ Digit Pin store that hash in a database table with 2 fields the hash and a field to say if the key has been tuurned in. User clicks the link (www.website.com/link.php?KEY={KEY}) Request the user enter a pin they assigned previously then hash the key along with a provided PIN in ...


0

Your question is very general and as far as I understand, nothing more than a regular authentication plus anonymization of the data. It is definitely possible to ensure non repudiation and anonymity by pseudonymization. What you refer to is a regular access control system which is included in most common frameworks. In case you need a more enterprise ...


1

This is a base64 encoding followed what seems to be a substitution cipher. Since it is monoalphabetic, it should be easy to crack. Have fun: http://www.cryptoclub.org/tools/substitution_cipher.php


3

The trailing = usually proposes that it is encoded (not encrypted!) using base64. You can decode it simply as from Linux shell (or there are some web tools): echo "Wmd5emhzIHhya3N2aSBkemggbGlydHJtem9vYiBkaXJnZ3ZtIHVsaSBnc3YgU3Z5aXZkIHpva3N6eXZnIHptdyByaCB6IGhrdnhyem8geHpodiBsdSBnc3YgenV1cm12IHhya3N2aS4gR3N2IHVvenQgcmggemd5NGhzMWhoMGgxbmtvMw==" | base64 -d ...


0

The Boneh-Lynn-Shacham signature scheme works only in special elliptic curves that support efficient pairing computations. This is not something that you somehow add on top of an existing signature; it is a signature algorithm in its own right, that uses its own kind of public/private key pairs. If you want something that works with X.509, then you need a ...


1

Use of long random tokens as secrets to provide access to a file can provide effective security. I'd recommend 128+ bits to make it truly outside the range of randomly guessing. You could probably get away with fewer bits, especially if you rate limit IPs based on bad guesses. E.g., if you had a 64-bit or 80 bit token and a billion such files and were ...


0

I'm surprised nobody mentioned bitcoin. While hashcash may have been impractical for email systems, it has proved useful in cryptocurrencies algorithms for proof of work of miners. "Hashcash is a proof-of-work system used to limit email spam and denial-of-service attacks, and more recently has become known for its use in bitcoin (and other ...


1

These types of questions come up from time to time. Essentially, this is security by obscurity. The fact that it is hard to guess only addresses one type of issue. It does not protect against: Users accidentally sharing the link, bookmarking the link, etc. The user accidentally typing the url into Google or another search engine, resulting in it being ...


2

While it definitely does provide a degree of security, it still leaves you a number of security holes that may or may not matter dependent on the type of application you are developing. For a non-exhaustive list: Content may meant to be limited to a select group of users, what if one of them leaks the URL? URLs with GET parameters are stored in a large ...


1

As already stated, this is that way by design. Probably MSDN article could (or should) be more explicit about that. The way you extracted the "signed" data is wrong. The XMLDSig documentation is clear about it. You may want to read section 8.1 of this link https://www.w3.org/TR/xmldsig-core/ Just as a user should only sign what he or she "sees," persons ...


1

XML Signature are prone too many attacks. That is due to the way XML as a file format is defined and how it is implemented by (parsing) frameworks. https://www.owasp.org/images/5/5a/07A_Breaking_XML_Signature_and_Encryption_-_Juraj_Somorovsky.pdf https://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/att-0019/Camera-Ready.pdf


1

To me, this seems not really as a error of the protocol but as wrongly used. You get a part of the XML using Doc.SelectSingleNode("/message/msgenvelope") but you never checked that "/message/msgenvelope" is actually the signed part of the XML! You have to treat the XML more like a file system with different files and not like one entity. Think like this: ...


1

Apparently the sessionStorage is not really cleared when closing the tab. It is easily revived by clicking on "Reopen closed tab" I've written more about it in here: http://blog.guya.net/2015/08/25/the-never-ending-browser-sessions/


2

Anything what the browser can do without human intervention can be automated. This might be done from outside by looking at the code or one might simply control the normal browser with Selenium or similar tools. Since you will pay users for visiting the page the chances are high that somebody likes to earn easy money and will automate the visits.


6

In addition to @Mark Buffalo's excellent response, there's another aspect - For some communications it is sufficient to delay the adversary's access to the data, rather than to deny it. The 'Security through Obscurity' nature of Code Talking is sufficient to this limited goal. Code Talkers, like the Navajo in the Pacific Theater, and more recently the ...


14

Good question. I'm a Native American, and this is pretty well-known to us. I also have experience with Chinese language and dialects. I'll explain why I'm mentioning the Chinese part later. This is a very good example of security through obscurity. It works until it's figured out. However, there are so few Navajo speakers compared to English speakers, ...


6

Refer to the guidelines set up by the CA/Browser forum for extended validation. 8.5.1 General The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity,Business Entity and Non-Commercial Entity requirements specified below. 8.5.2 Private Organization Subjects An Applicant qualifies as a ...



Top 50 recent answers are included