Tag Info

New answers tagged

0

With identical key and IV, you'll produce identical ciphertext for identical plaintext. Scenario: You send messages to your broker via this scheme, and don't worry about the messages being intercepted because you've encrypted them. C1 reads: Stock: Cocoa-Cola Order: Buy Shares: 1,000,000 Price: > $20 Someone steals your SD card while you're not looking, ...


4

TLS_FALLBACK_SCSV fails to protect against Logjam for the same reason that Logjam actually works. That anti-fallback mechanism relies on the client putting it in the ClientHello, and being ultimately part of the input to the hash function that computes the final Finished message. This works only as long as the active attacker cannot break the handshake ...


1

No. TLS_FALLBACK_SCSV won't work for this. It's just the client saying "Look, you made me come back a second time and with a downgraded protocol version!" But Logjam or FREAK do not depend on a second connection. It works with the first connection. The downgrade is not on the protocol level. It's in the parameters that are delivered.


1

In counter mode (CTR) no single block of cipher is dependent upon a previously calculated block. Each block can be calculated independently of every other block. This could be parallelized by splitting the cipher into chunks for individual threads to encrypt or decrypt. Say you have a 512 byte block of data you want to encrypt. Using AES128-CTR there ...


2

You must not do this. AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to produce ciphertext. Using the same key and IV produces the same ...


0

I believe your reasoning is solid, its just flawed as @SOJPM pointed out: I think SCSV prevents Protocol downgrade attacks (f. ex. TLS -> SSL) whereas FREAK and Logjam attack weak cipher suites. – SOJPM So TLS_FALLBACK_SCSV protects the protocol used not the cipher suite. You should disable export ciphers, SSL, RC4, etc... due to the simple ...


3

In general, for penetration testing, you must have acute and precise notions of how computers work. You must basically understand how things go "under the hood". For instance, you do not need to be a god of assembly programming, but you must have some notion of how, conceptually, a buffer overflow can result in hostile hijack of your server from remote ...


0

I am surprised that people haven't noted that you can and should encrypt the verifier in the db. Typically with large firms the databases are segregated infrastructure. The backup regime of the database servers is also usually deliberately different than the host level backups of the applications servers and web infrastructure. Db backups are usually offsite ...


3

Nope. Cryptowall encrypts all your data using AES, with a randomly generated key. That key is encrypted with an RSA public key, for which the bot controller holds the private key. When you pay the ransom, they decrypt the AES key using their private RSA key, which allows them to decrypt all your files. This particular type of malware is particularly ...


0

To answer your question, yes, you can share the host key on all the servers in your load balanced pool. Then, you do the host key verification once for the IP/DNS entry you are load balancing and it will log into any of the pool members from then on without asking you again. Before I go any further, for those wondering why you would do this. This may not be ...


3

The "padding oracle" attack you are talking about is better known as Bleichenbacher's attack against RSA. The attacker sends malformed encrypted keys; some will still (by pure chance) happen to decrypt properly, albeit with a decrypted content that the attacker cannot know. If the server's behaviour changes, depending on whether the decryption failed ("bad ...


0

It depends on a lot of things. Let's consider a message encrypted by OpenPGP, the most used encryption standard. By default, it includes in plain text a field containing the key ID the message has been encrypted to. However, note that the OpenPGP standard allows for this field to be empty i.e. containing a key ID = 0x0. So the correct answer to your ...


0

The only way you could match a encrypted text to the key-pair it is used with would be to own the private key and successfully decipher the message. Apart from this, there is no telltale sign as to which public key has been used to, as any message could have been used for encryption. Though, the protocol could tell you. For example, the OpenPGP protocol ...


5

Single, unpadded input chars That implementation you linked operates on individual characters. So patterns are repeated. Also these characters are not padded in any way. Padding would prevent such easily spotted patterns. Not the real thing So this is somewhat RSA like. But it is not actual RSA. (Because PKCS#1 mandates padding.) Wikipedia calls this ...


2

I think you're confused because of a misunderstanding between encrypting and hashing. I'll try to clarify by quoting your original post. "When you view the configuration of the appliance it shows the key as a cipher text (imagine perhaps the idea is stop people shoulder surfing the key of the appliance). So the plain text key I entered in the appliance ...


2

Approaching your second question, rather than using a different crypto algorithm, you can replace gpg in symmetric mode with openssl: echo "plain text" | openssl enc -aes-128-cbc -nosalt -pass pass:secret Beware: For sample purposes, I am providing the passphrase in the command line. See PASS PHRASE ARGUMENTS in openssl(1) for better ways of providing ...


-1

I like the idea of rolling your own. Thing about mathematical/cryptographical discoveries today is that it's hard, probably impossible, to get peer review. Because it's probably as much or more work to vet whatever one comes up with as it was to come up with it. This should NOT deter the fun of exploration and discovery. Asymmetric schemes are harder, more ...


1

You don't use a hash function to encrypt things. You use an encryption algorithm. You don't use an encryption algorithm to sign things. You use a signature algorithm. The text you quote uses to traditional explanation of signatures as "encryption with a private key", which is a very confusing way of stating things, and works only for a specific signature ...


0

How is the hash derived, and how is it secure? The hash is derived using a cryptogaphic hash function. Hash function usually have the following three properties: Preimage resistance: From a given hash you can't (easily) find out the corresponding input to the function 2nd Preimage resistance: From a given hash and a given input you can't (easily) ...


0

Here's a link to a related question. The general answer is that before the message is signed with Alice's private key, it will be hashed with a hash function of Alice's choice. RSA is not tied to any specific hash function. Alice will include in the header of the message which combination of hash function + signing algorithm she used. For example: in TLS ...


5

In addition to the encryption initialization vector (IV), the symmetric key derivation uses a random salt to protect against offline dictionary or rainbow table attacks. Specifically, the Iterated and Salted S2K (String-to-Key) packet contains an 8-byte salt.


6

Usually, symmetric encryption starts with a random initialization vector (IV). OpenPGP uses a slightly different cypher feedback mode with an all-zero IV, but the first two blocks are random. Because of this, also the symmetric encryption is not deterministic; you cannot compare the plain text by comparing the encrypted message, the encrypted result is not ...


2

Some things to consider when dealing with TLS as a protocol. The payload of the communicating packet is encrypted. The 'dst' & 'src' packet attributes are not, which allows for any device within the network route to intercept your communication. Numerous attack against the SSL & TLS protocol over the years have allowed for the following attack ...


0

This is an old piece of malware. Though technology isn't a panacea, if you're having this problem it seems like your technical protection needs an update. If updated, I feel like offering that if it were easy to do this at a server it would already be implemented at the workstations: To identify files associated with CryptoLocker you need a signature, and ...


1

It's only tangentially related, but David Aspinall (University of Edinburgh) and Mike Just (Glasgow Caledonian University) published a paper on partial passwords in 2013: "Give Me Letters 2, 3 and 6!": Partial Password Implementations & Attacks. Their paper looks at online attacks for which the backend storage mechanism is irrelevant, but it makes a ...


6

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption capabilities. It ...


0

TPMs are verifying, that computer runs only signed code. It usually builtin motherboard. HSM used to store private or symmetric keys for encryption.Usually it is separate network deivce.


0

I take it that your question is: How do people determine if a cryptosystem is weak? Well there are two types of people who need to do this as you pointed out: the ones who made the system and those who want to break the system. If the process is symmetric, then all we need is that the process is not linear. That is why AES won - it is long and ...


6

For cryptanalysis, the usual three-point method applies: Write down the problem. Think real hard. Write down the answer. And that's about all that can be said generically. The methodology of a cryptanalyst is about the same as that of researchers in any other science. The core of the daily work of a cryptographer is to read, read, read all the papers. ...


1

Tracking down the links referenced in the answers, I think it would be safe. Out of an abundance of caution, I will exclude the private key from the list of md5sum values I allow to be stored on computers connected to the Internet. I will then use the signatures generated for the same binary to confirm the excluded private keys are identical. Even if ...


0

Although it is only the collision resistance property of MD5 that has so far been compromised, I would not use MD5 for any cryptographic purposes even though in your case an attacker would need to compromise the pre-image resistance. Use a secure algorithm such as SHA-256.


1

Looking at your comment on @zedman9991's answer; if you want to check that the servers' filesystems are identical, why not generate one hash for the whole filesystem, rather than one hash per file? This will likely fail on two different severs since operating systems generate files like candy, timestamps / MAC addresses will differ, etc, so it might be ...


0

Nobody else has made it explicit in a simple way yet, so I will do it: 1: You look at the certificate given by yahoo and confirm it matches the domain. 2: You perform a key exchange that is AUTHENTICATED using that keypair, for example it can be done through signing key exchange parameters. This confirms you're really talking to Yahoo and establishes a ...


2

In some cases it might actually compromise the security of it. http://www.di.ens.fr/~fouque/pub/crypto07b.pdf HMAC-MD5 has a key recovery attack in the upper end of achievable but impractical, although attacks only get better over time.


0

Your question is: How does a single public key on the server allow messages to you be private and secure, without a HTTPS certificate on the client? Good question. The answer lies in the mathematical fact that it's easy to raise a number to an exponent, but hard to factor a large number. You need to understand exponents and accept the fact some math ...


2

That's not quite what happens. As public/private key encryption is more expensive than symmetric encryption, its use is minimal. During the SSL handshake, the client and server agree upon a shared symmetric key that they use for bulk encryption. The remainder of the communication then occurs using this symmetric key. This symmetric key is then rotated on a ...


0

You are not connecting to public web sites with a certificate of your own. The server does have a key pair in its certificate. Therefore, yahoo can't identify you; but you can identify yahoo. Setting up an encrypted link is actually unrelated to the certificates. A simplified way to think of SSL is: 1) identification phase (certificates), then 2) key ...


2

You can use the MD5 cryptography hash without any serious concern but why not consider using the public key to confirm the private key in question. You could have the partner sign a sample binary and use the public key to confirm the signature and thereby confirm the private key. If you want to work outside the signing infrastructure you could use a ...


2

WARNING: Creativity ahead, which is often bad for security (at least without thorough review). This sounds like a case in which an SSH agent could be useful. An SSH agent provides a socket interface over which SSH clients can ask the agent to perform key operations for them, which enables the following common uses: You can have the long-running agent ...


4

1: Use hardware tokens, like a Yubikey configured for challenge-response based authentication. Or smartcards. You load up the key on them all and hand them out. They're designed to keep the secrets secret. 2: Stop using a single key, start using one keypair per user for accountability and practical revocability.


0

Well besides the sudo answer (which is really clever btw), another solution is a restricted shell. In this case you would have to write one. In this case the only commands you need to accept are "ssh <hostname>" and "exit" so it's not so hard. I'm really only posting this for completeness, but the general technique is valuable in other contexts.


2

I don't think this should be an issue - using a single key pair to access many servers is perfectly fine and most of the world works that way. Its important to understand, as @Tom Leek mentioned, that the private part of the key - which must stay secret - is only stored on your single machine and is never transfered out of it. So even if one of the servers ...


1

The exit node doesn't need to know the public key of the client, because they operate on symmetric keys. Tor's design document has a section where it describes how circuits are built. The client (called onion proxy) sends a CREATE packet (or cell in Tor terms) to the first relay. It uses Diffie-Hellman key exchange to construct a symmetric key. The first ...


1

The client uses Diffie-Hellman to negotiate a session key with each node when establishing a circuit. This is done incrementally, so each DH handshake (after the first) is routed through the existing partial circuit. https://svn.torproject.org/svn/projects/design-paper/tor-design.html#subsubsec:constructing-a-circuit So, the exit node has a shared session ...


1

You are using ECB mode, that is broken. You could replace it with CBC. You reduce the key to half strength as you compose a key of only hex characters. The initialization vector does nothing in your code because of the ECB mode. If you actually had an initialization vector you would have to send it along with the encrypted message, and use that for ...


0

It is not true that you use a static salt, salt must be random number with fixed length for each input.


0

Suppose there are two type of drinks which are widely believed to be the same but in different packaging. But A knowing the fact that they are same tries to discover a test to distinguish between the two. Next A would like to convince B that two drinks are not same. a) A trivial way to prove it would be for A to send the details of her test to B and let B ...


1

This indicates your private key is encrypted with a passphrase. pgpdump does not decrypt private keys to display them. With GnuPG 1 and 2, you can at least export unencrypted subkeys using gpg --export-options export-reset-subkey-passwd --export-secret-subkeys [key-id]. This will also print the secret x part of your key. For GnuPG 2.1, this option was ...


4

If the attacker knows the encryption method, then assuming it's a decent algorithm it won't help them break the cipher in any meaningful way. Cryptography is designed and analyzed under the assumption that the attacker knows everything except the key; among other reasons, it's incredibly hard to keep the attacker from knowing the system, while a key is much ...


4

It depends what you're worried about, and what you are really trying to protect. If each of these slices is individually important (say a 1 MB list of credit cards), then you're basically just encrypting each chunk by itself. The total strength of protection for each chunk is just the size of the key you used for that chunk (modulo strength/weakness of the ...



Top 50 recent answers are included