Tag Info

New answers tagged

-1

Try for instance openssl speed aes rsa2048 or, if you want to have faster asymmetric operation openssl speed aes ecdsap256. The AES-128 and ECDSA has comparable security level. RSA 2048 is actually less secure and slower. If you want to have a fair comparison you may want to turn off AES-NI otherwise AES may get CPU assistance while RSA (presumably) will ...


2

The point of strong password hashing functions is to make password processing slow so that attackers find it harder to run a brute force attack on your password. Unfortunately it makes it slower for you too; this is the limit of the exercise. At best, you make the function n times slower for you and n times slower (with the same n) for the attacker; but the ...


2

Bitlocker uses AES in CBC mode, Truecrypt and others use AES/Twofish/Serpent/cascades in XTS mode (Wikipedia: Block cipher mode of operation). CBC mode is less secure in that it allows single bit manipulation, for example switching a specific bit of data when attacker can gain physical access to the machine then return it to you. This can open backdoor ...


3

Terry Chia answered the question "What is the benefit of rotating certificates so frequently?" fully correct, so there's nothing for me to add. However, I'd like to add a note that Google does frequently change their public keys as well, so the assumption of the cheat sheet is invalid. This does add pretty much confusion and may be part of the reason for ...


30

One big advantage is removing the need for revocation in the event of a compromise. The "typical" way to do this is publishing a certificate revocation list (CRL) or using the OSCP protocol in the event of a compromise to revoke certificates. However, the CRL or OSCP check is incredibly easy to bypass. An attacker in a position to perform a MITM attack can ...


0

The real question is whether you're using a signing/authentication GPG subkey as your SSH key, or an encryption one. The former is fine, the latter is not: an RSA key must never be used to both encrypt and sign! (Authentication uses digital signatures.)


0

The main application of message recovery in digital signature schemes is: You save space. You can sign a message and don't have to send it, just the signature, so you're saving (up to 1 keysize) bytes of transmission. However there are reasons why it's uncommon to use digital signature with message recovery: DSA family of signatures don't support it -> ...


1

Yeah this is explainable by how these modes work. Note: The input to the mode must be a multiple of the blocksize. (That's why this can be lower than 128-bit for a 128-bit cipher) Now observe how CBC works: NewBlock(LastCiphertextBlock,PlaintextBlock):=Encrypt(LastCiphertextBlock XOR PlaintextBlock) As you can see this can only encrypt a multiple of the ...


0

My simple recommendation, and what I have done to mitigate DoS attacks on slow password hashing, is to use a password strength calculation score as primary validation method. So for a user login example: I get the user record by email. Then first check if the strength score match against the plain text password (which is obviously fast, just a couple ...


1

Another approach or approaches that you can take to try to solve this problem is the idea of a semi-fragile signature. A semi-fragile signature is a digital signature which can be verified even when the data undergoes a limited set of transformations. I developed the concept originally (I called it a robust signature) in context of limiting the set of ...


2

You should stick with /dev/urandom. Thomas Hühn has a good overview at http://www.2uo.de/myths-about-urandom/ If you are really concerned you can look at using a user space CSPRNG. Stick with well understood CSPRNGs (e.g. Blum Blum Shub, although it has some performance issues) and respected implementations. You might want to read ...


0

Thinking a bit outside of the box, you could code a variable to store the md5 of a file (the exact file) and so while the actual md5 of the file in plane text will not be included in the file itself, if the file were runnable code it could be programmed to store a value of its own md5 as a variable. To further enhance such an idea (in order to give it some ...


0

RC4 has its flaws and arc4random specifically had some issues about 7 years ago (CVE-2008-5162) yet it is expected to be secured Also, note that urandom is not the best idea or as Wikipedia says: A counterpart to /dev/random is /dev/urandom ("unlimited"[5]/non-blocking random source[4]) which reuses the internal pool to produce more pseudo-random bits. ...


1

It sounds like what you really are looking for is a zero knowledge proof (or several zkps). You want to prove that (1) data belongs to a given class (general contents) and (2) that the data is within some limits (upper/lower bounds). Since you also want to transmit the data through the system, you'll need to bind the proof to the data in such a way that ...


2

As described in this answer and in this commit to chrome only AEAD ciphers are considered state of the art security. It looks like that your server does not use the cipher preference of the client but instead has their own preference which looks like this: ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ... ...


0

I ended up asking on the OTR's developer mailing list and here's the response I got: On Wed, Apr 08, 2015 at 02:51:14PM +0200, Jacek Wielemborek wrote: Hello, Here's something that keeps bugging me for a moment. It's a hypothetical situation, so please refrain from question like "how did you send the FP to your friend?". ...


-1

It is actually the usage of a SHA-1-signed certificate. Everybody (including Google and Mozilla) is phasing them out. Edit: Open that address in a new tab and take a look at the browser's console. There should be a link that will give a better explanation about what the issue really is.


3

Now please suggest me the possible parameters to judge my algorithm. The most important parameters at the current development stage of your algorithm are probably: your understanding of other algorithms your ability to break other algorithms, or at least to fully understand how others manage to break them your knowledge of number theory your ...


6

In TLS, MD5 is used as the compression function for HMAC. The best current security proof for HMAC does not require its compression function to be collision-resistant, so HMAC-MD5 is still considered secure (if distasteful). TLS 1.0 and RC4 are more disconcerting than MD5 in this case.


1

That this page is using MD5 is bad. Even SHA-1 wouldn't be nice. But hashing and authentication are two different things and as far as I can see this site uses HMAC-MD5, which does't need the collision resistance although this would be nice to have. This was already discussed here. Well, the cipher suite this site is using to connect to you is pretty bad. ...


1

To expand on @aron-foster's answer, the way that this is done in public key cryptography is to first hash the message and then encrypt the hash using the sender's private key. In public key cryptography, as you likely know, data encrypted with one of the keys can only be decrypted with the corresponding key. This means that when the hash is encrypted with ...


3

Yes, that's correct. That's why if you're using a hash for data integrity then you must deliver the hash by separate means (eg. posting the hash with your twitter account). To get around this problem in emails, rather than using a hash you can use public key cryptography that allows the receiver (and anyone else) to verify the signature using your public ...


2

Possibly partial answer. First an aside: you don't need to "secure" a public key by changing bits; the whole purpose and point of public-key cryptography is that it is secure even though the public key is public, which includes available to adversaries. That publickey form you have is NOT just "modulus and exponent". It is true that the last 3 bytes in ...


2

I also have this following sha512 encryption system, which was created by Sammitch Why not use password_hash? The only reason I can think of is that you are using an old version of PHP, in which case you should update PHP. I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. Don't ...


7

It is unknown (except probably to Microsoft and the NSA) whether BitLocker has a back door. You cannot examine the source code to find out, either. (And even if you could, a purposeful weakness might be very difficult to spot, even for an experienced cryptographer.) TrueCrypt's source code is available and has (as of today) been audited. No back doors or ...


3

Since this doesn't seem to have been done yet, I am going to suggest an answer from a purely information theoretical point of view: Let X, Y be two random variables in {0,1}^n. Let f(x,y) = x XOR y Now, H(X,Y) = H(X)+H(Y|X) = H(Y)+H(X|Y), and since the information entropy is always nonnegative, we have H(X,Y)>=H(X) and H(X,Y)>=H(Y). So the join random ...


0

To me, the main reasons are related to key management, rather than cryptographic security per se. For asymmetric crypto, especially the period during which you want a public key to be valid may strongly depend on the intended use of that key. For example, consider a system in which a component must authenticate itself towards other components. Next to ...


1

It is quite possible to create a stronger RNG using the suggested method, however it is also possible to create a weaker RNG, or one that does not improve. The end result depends on the properties of the weaker RNGs. Bit distribution and bias has just as much effect as the entropy level. Only careful analysis and knowledge of the entire scheme can tell if ...


1

The quick but overly vague answer to your original question is: Yes. However, as most people have indicated: more secure != secure. The purpose behind RNGs/PRNGs is to produce sufficient entropy to make it infeasible for an attacker to guess enough information to recover sufficient protected data. Most sources of entropy are tested to determine whether ...


3

This probably sounds like snark, but your solution only improves the situation if the two PRNGs are themselves chosen with sufficient randomness. Think of the reason that we consider a weak PRNG to be insecure: the result is statistically easy to guess some/all of, resulting in crypto and other operations that can be attacked by knowing part of the input ...


1

Unless one is perfectly random, the end results is unclear. But if one were perfectly random, it would not be weak any more. Edit: Unless you're sure the two are completely independent of each other, the benefits may be unclear.


1

The host has a key pair, consisting of a public key and a private key. (It can have multiple key pairs in different formats; at the beginning of a connection, the client and the server negociate to determine a format that they both support.) There's a host public key and a host private key; there are also other key pairs (public and private keys) which are ...


2

The difference between the two keys is that the Master key (PMK) is supposed to be valid for at least as long as the client is connected. In the case of WPA-PSK, the PMK is the same from the moment the AP is configured until either the passphrase or the SSID changes. Therefore, if the PMK is compromised in any way, the attacker gains "permanent" access to ...


0

You can use the HSM to store and manage your keys but you should also be able to use the HSM to perform encrypt and decrypt functions on behalf of your database or application. It depends on the functionality available on the HSM you have or are considering using. Here are a some examples of how you could use it: 1) Store a symmetric encryption key within ...


0

MSDN Data Encryption and Decryption Functions You choose what algorithm to use. You have to use CryptAcquireContext to get a handle to the Crypto Service Provider. Then call CryptGenKey to generate an encryption key object. This function is where you define the algorithm you want to use. You need to also call CryptCreateHash to create a handle to a hash ...


0

The data in the cert is hashed and the hash is sighed with C's private key. C's public key is in the cert. All of this is hashed and signed by a CA's key. Changing the subject changes the hash, the new cert is bad without even verifying the first signature.


0

It depends on the individual malware, but normally a random symmetric key is generated on the machine (which is used to encrypt the files), which is then encrypted with an asymmetric public key embedded within the application. This encrypted key file is kept locally on the system, but it is useless unless you have the private key to recover the symmetric ...


1

The reason AES-CBC isn't an authenticated mode has everything to do with the CBC and nothing to do with the AES. CAST5-CBC isn't inherently authenticated either; changing one bit in the IV changes the corresponding bit in the first block, and there's no way to detect it, because that's a result of the CBC construction and not of the cipher.


3

Answer depends on your security model. Classically, a cryptographic hash function has three properties: It resists preimages: given y, it is infeasible to find x such that h(x) = y. It resists second preimages: given x, it is infeasible to find x' such that x ≠ x' and h(x) = h(x'). It resists collisions: it is infeasible to find x and x' such that x ≠ x' ...


-1

Why not just use a CRC-token? or alike. without knowing what it is you are securing against with the hash no-one can tell you what to do (and the least amount of data added for verification the better for speed). truncating a hash does not help in general. because all you do is expose more of it to collision attacks.



Top 50 recent answers are included