Tag Info

New answers tagged

0

That's basically impossible to tell, in general. However, they're visibly base64 encoded. You could try running them through a base64 decoder and see what you get.


4

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible values for each character, so if your hash ends up being say, 70 characters long, there are 70^62 possible combinations. Most hashes are expressed ...


1

I'm far of being an expert in crypto but I think that if you look at the result of the hash function as a stream of bits it's just the same if you "see" it as a UTF-8 string or Base64. The way you see it may be different but the actual binary value is the same. But this is just an assumption I made


5

First, Base64 will use, well, 64 different chars (hence the name) to encode binary data. The almost only set of symbols used is this: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ I am not aware of any implementation that uses a different one. According to Wikipedia, "A hash function is any function that can be used to map digital data ...


6

I think the answer comes straightforward from this quoted paragraph (Module Validation Lists) -I emphasize the important thing in bold: A product or implementation does not meet the FIPS 140-1 or FIPS 140-2 applicability requirements by simply implementing an Approved security function and acquiring algorithm validation certificates. Only modules ...


4

This is where you must read carefully. Compliant means that the vendor believes they have followed FIPS encryption requirements and their product meets the specificaiton. Certified means that the product has actually been tested by NIST and issued a certificate number. Certification is an expensive and time-consuming process, and must be re-done after ...


10

SSL/TLS are protocols. OpenSSL is an implementation of these protocols. It has two libraries: libcrypto which implements a set of encryption algorithms, and libssl which implements TLS protocols and its previous SSL. If there is an error in the implementation of a given protocol, it does not mean the problem is the protocol itself. HeartBleed is just a ...


21

If you look at the Heartbleed summary: The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet ...


3

While the currently accepted answer is correct and the number of iterations is usually stored where the hashes themselves are, even if this was not the case: By Kerckhoff's principle, you should assume the attacker can find out. In practice they could find out for example by creating their own login with a known password or timing a login attempt. Even if ...


4

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would need to do is: Create your own root CA Make those devices trust your own root certificate Redirect all SSL traffic from those devices to your proxy When a ...


0

You can use your computer as a proxy server using "Squid" and configure SSL dump by decrypting the traffic, analyze it and re-encrypting it again and send it to its destinations. You will have to import the certificate created by Squid to your connected devices.


4

There is no standard way to do what you envision and I'm not aware of any proposals of relevance. The currently established PKI structure allows only for a single certificate chain (i.e. a single issuer for a certificate) and the TLS protocol like used allows only for a single leaf certificate. In theory one might create a certificate with multiple issuers ...


13

How does a hacker know how many times a password was hashed? The same way you do. The goal of hashing a password is to make it impossible (in practice very difficult) to determine the password, even with full access to all the data. The other requirement for hashing is that the server must be able to determine if an entered password is correct. This means ...


37

Number of rounds is often stored with the password and hash. For example, using bcrypt: $2a$10$oEuthjiY8HJp/NaBCJg.bu76Nt4eY4jG/S3sChJhZjqsCvhRXGztm The 10 indicates the work factor, effectively adding 10 bits of entropy in terms of hashing time to brute force. 2^10 = 1024 rounds. It is stored with the hash in case of the need to up the work factor due ...


8

The number of iterations and the salt are stored in the same database, usually in the same field as the password hash itself. Because the site needs to know those things just as much as a potential attacker does, and so they have to be easily available. For example, bcrypt hashed passwords contain the (log base 2 of the) number of iterations separated by $ ...


0

The short The MITM needs the private key of the server to pose as the server and decrypt private messages you send to to the server. The public key of the server is for authenticating messages signed by the server and sending private messages to the server, so you still need to verify its fingerprint. It's okay if the MITM has the public key too. All that ...


1

in psk authentication and 802.1x authentication methods, five main keys are generated. master session key,group master key,paired master key,paired transient key and group temporal key.paired transient key and group temporal key are generated after four way handshake. when you switch from one access point to another,the four way handshake starts again.


0

Why do certificates need to be renewed in the first place? That happens because: You lost your private key Your private key is stolen You want yourself to revoke the old instance of your certificate Your certificate reached its expiration day The password that protects your private key has been compromised You have misused somehow your actual ...


1

Requirement 2: Opt-in revealing of name and email Option 2 can easily be done without your server having to always remember UserId & user's email: When the user wants to post a non anonymous message, the user supplies his name and email address. If identity sproofing is a problem the user can keep a certificate proving that he owns the given username ...


1

If I understand you right than you want to make sure that no user data are compromised even if your site gets hacked. First you should be clear that this only can apply if you detect hacks to your site. If the attacker manages to hack your site and you don't notice this then the attacker can track all activity on this site and probably de-anonymize the users ...


0

You could create a proprietary encryption algorithm, but to ensure that it is secure you would need to make it public, so it can be properly tested. (bar the secret key obviously). Security through obfuscation is not recommended. This is the basis of Kerckhoffs's principle. "The principle goes as follows: A cryptographic system should be secure even if ...


0

Most HSM's allow for using custom code, but in general you have to ask the specific vendor, it's not something that they advertise. Often it breaks certification. On the other hand, running applications that can e.g. validate the input can make for a much more secure experience. Generally these applications are sandboxed and need to be signed. Of course, if ...


0

Posting an answer because the current answer has some inaccuracies. Your first two points are correct: DV certificates have a subject that's a domain name, and whois information is frequently used for contacting the owner of a particular domain to give them a DV certificate. no hacker should be able to register a DV SSL for my domain and / or setup a ...


4

Short answer: It will need internet connectivity briefly, then it will encrypt everything even if you disconnect. Long answer As soon as CryptoWall runs, it will generate a random RSA public and private keys, connect to one or more control servers, and upload the private key along with some information on the system it is, like OS version, public IP and ...


2

Another method of solving for m comes from this paper. Essentially, this method exploits the fact that the linear congruential generator dramatically fails the planes test. The determinant of a 3x3 matrix using 4 outputs is a multiple of m. The gcd of two multiples (n_1 and n_2 of m is m if x_1 = n_1/m and x_2 = n_2/m are co-prime. The probability that k ...


7

Passwords are hashed for the case that an attacker can read the hashes from the database (e.g. SQL-injection). Afterwards he can brute-force with the full speed of his own environment, often with a GPU, this is called an offline attack. A sleep on the other hand could only protect from online attacks, even then an attacker could make multiple requests and ...


6

An existential forgery of a chosen plaintext is having the ability as an attacker to obtain a valid MAC for a plaintext of your chosing, without knowing the key required to generate a correct MAC. A common vector for this is a timing attack, and that would work like this: The attacker sends a message, and an HMAC (really just a sequences of bytes the ...


5

What is a session key? A session key is a single-use symmetric key used for encrypting all messages in one communication session. Scenario: Alice would like to establish a secure communication with Bob. But she cannot provide the key in plain text, otherwise someone sniffing the communication might be able to decrypt the information later on. What ...


4

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


1

Technically, encryption always have a performance impact, in todays machines it's negligible. For best outcome, you could perform the following: Get the RSA public key of the server side. Create a symmetric AES key, encrypt it with the RSA public key and send it to the server; the server decrypts it and you have a 'pre shared secret' then. Encrypt your ...


0

One of the main reasons for hashing passwords and not encrypting them is that people tend to reuse passwords (or minor variants) across many sites. So a password disclosure puts your site at risk and the user across all sites that they've (foolishly) reused that password. A better strategy is to obtain a temporary piece of data for the user that securely ...


7

Short answer is: Yes, RSA is useless in this case. If all the game logic happens on client side, you cannot prevent cheating. If your game is reporting only the final score and nothing else, no encryption can help. The game must know how to submit the score and so the full information will always have to be stored in it. You can only make it harder for the ...


0

If your client can send the time, the server could issue certificates for the public key to the client with an expiration time as opposed to hard coding the public key in your app.


0

Perhaps the app should use Kerberos to authenticate to the server, as well? E.g. using constrained delegation. Alternatively it could have a SSH key of its own, one that works for all accounts but only from the webapp server's address.


0

There are three issues about that procedure: What if the encryption key is compromised? Are you going to use the same key to encrypt all passwords ? Adobe's system uses a different key so that if a key is compromised only one user would be affected. Storing sensible data such as, in your case, a part of the data used for your cryptography process in ...


2

First of all, I feel you are quite a mysterious person because no one could pretend to break 4096-bit RSA in the foreseeable future so I wonder why you need such a very long key. Coming back to your questions now: But in which operation is this the case? Generating the keys? Encryption? Decryption? Signing? Verifying? All of them? RSA keys are used ...


3

With the Great Firewall of China, the country has a tight grip on its communication infrastructure, especially on the IP and TCP layer, however there are still some options left. It all depends on the volume or reliability though. Be careful! By using VPN or TOR you will become subject of investigation, especially if you are building connections to the USA ...


0

Based on what you have outlined, your solution seems overly complex and I'm not sure why you wouldn't just encrypt the data rather than hashing it. There may be limitations in what you can store in the remote app that may require encoding the encrypted data (similar to what needs to be done when sending encrypted email). This would eliminate the need to ...


3

how can I mitigate and protect against such vulnerability warning Well, generally speaking, everybody knows that defending against DoS attacks -whatever their nature is- is a difficult and expensive thing to achieve. Coming back to your essential problem, it happens when an attacker overwhelms your server with secure connection requests leading it to ...


4

The EBICS financial protocol (European alternative to SwiftNet) can be a pertinent real life example. It uses three certificates respectively for authentication, signature and encryption. Most (if not all) banks use three different certificates. However the official protocol specifications allows the use of the same certificate for authentication and ...



Top 50 recent answers are included