Questions tagged [algorithm]

Algorithm is a set of step-by-step operations to be performed including calculations, data processing, and automated reasoning.

Filter by
Sorted by
Tagged with
535
votes
11answers
87k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
36
votes
2answers
22k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
33
votes
5answers
8k views

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
21
votes
7answers
5k views

Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
20
votes
4answers
3k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
15
votes
1answer
5k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
14
votes
4answers
5k views

Implementation of diceware: do I have to simulate dice roll?

I am creating a small utility for generating passwords based on the diceware method. At the moment I am very close to the algorithm of real diceware - i.e. I simulate rolling dice n-times to get a ...
14
votes
1answer
4k views

Why is asymmetric encryption less efficient than symmetric encryption?

It's common knowledge that asymmetric encryption is in general much more expensive to compute than symmetric encryption, thus common practice is to use asymmetric encryption to establish a symmetric ...
11
votes
2answers
1k views

Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm

I had asked last year about the encryption claims by the web service called https://unseen.is. The very same service that had claims of "beyond army level encryption", "4096 bit keys" etc. This is the ...
10
votes
1answer
14k views

Is knowing the decrypted and encrypted data enough to find the key?

Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out? ...
9
votes
5answers
5k views

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

I want to protect some registers by encrypting them without providing additional memory space. Is there a encryption algorithm that will maintain the length of the data to be encrypted? (i.e. ...
9
votes
4answers
1k views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. a-z,...
8
votes
2answers
20k views

Why is MD5 considered a vulnerable algorithm?

I know that MD5 is the most vulnerable hashing algorithm, and particularly vulnerable to Collisions. But the collision vulnerability is not very risky and somebody might use that as an advantage, but ...
8
votes
5answers
988 views

How to prevent pay per show/click abuse?

We have a webapp. 3rd party websites put our banners on their pages (banner is a snippet of HTML). They are paid for it using "Pay per click" or "Pay per show" methods. So 3rd party website's owners ...
8
votes
1answer
3k views

Identifying an unknown hash

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
7
votes
1answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
7
votes
3answers
1k views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
7
votes
4answers
496 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an n-bit password in time O(n^(log n)), is there need for alarm? This question arises ...
6
votes
2answers
1k views

Do all Authenticator Apps use the same algorithm?

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ? So, these apps are use the same algorithm which is a ...
6
votes
1answer
8k views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
6
votes
2answers
4k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
5
votes
1answer
396 views

Drawbacks of ML in cyber security?

I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats ...
5
votes
2answers
700 views

Is it more secure encrypting 3 times with GPG?

Let's say we are using 3 different length passphrases and 3 different algos to encrypt sensitive data, e.g: gpg --symmetric --cipher-algo CAMELLIA256 < input.zip > output1 (random 100 ...
5
votes
3answers
171 views

Promotional code based on numerical value

I have a field userid which has value between 10000 and 999999. I want to create a promotional code which is based on this field. The promotional code will be used by the users to refer new users. ...
5
votes
2answers
3k views

Does chaos theory have any practical application in computer security?

Having learned about chaos theory at university some years ago, I've been curious ever since to know whether it has found any practical use in computing. Let me explain where I imagine it could be ...
5
votes
1answer
10k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
5
votes
1answer
467 views

What are covert channel algorithms?

Covert channels are normally used for communicating illegally or for some hidden communications, but I am trying to figure out what covert channel algorithms might be. Has anyone heard of this term ...
5
votes
1answer
144 views

Are there any modern governments which use a proprietary encryption algorithm?

Germany used Enigma during WWII. The Soviet Union used GOST during the cold war. USA used to use DES. Now that encryption algorithms are believed best as open source, are there any modern governments ...
4
votes
4answers
3k views

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?

For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?
4
votes
3answers
4k views

Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know the ...
4
votes
1answer
1k views

How to set an extremely weak password hashing algorithm for linux?

As part of a lab exercise I want to have an extremely weak password hash in the /etc/shadow file. How could I go about doing this? MD5 is not quite weak enough, and I'm editing the /etc/pam.d/common-...
4
votes
2answers
154 views

Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, '...
4
votes
2answers
730 views

which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
4
votes
1answer
215 views

Safe encryption algorithm that works with files bigger than 68GB

In my Java application, I used AES/GCM/NoPadding algorithm for encryption, however it throws an exception when I try to encrypt files bigger than ~68GB. From what I read, it is limit of data that can ...
4
votes
6answers
930 views

Methods for remembering passwords around the web [duplicate]

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
4
votes
1answer
145 views

How to responsibly disclose a vulnerability in a widespread algorithm?

Just to be clear, this is purely hypothetical. Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
4
votes
1answer
1k views

How to calculate cryptographic checksum using 3DES-outer-CBC mode

I want to calculate a cryptographic checksum using 3DES in outer CBC mode. As I know (and tried Googling also ) 3DES is an encryption algorithm, I'm not getting getting any information about how it ...
3
votes
2answers
2k views

How realistic and possible is this sort of attack

I scanned a host with Nessus, in order to do a vulnerability Assessment, and one of the findings looked really odd to me. Nessus rated this finding's risk as Medium. The finding was, that a service ...
3
votes
1answer
849 views

Aes encryption algorithm life time [closed]

How many years from now will we stop using aes encryption algorithm, as of now aes seems to be virtually immune to brute force attacks and not showing any weaknesses, will quantum or optical computing ...
3
votes
1answer
171 views

Standard for Generating Multiple WEP Keys From a Passphrase

I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full ...
3
votes
2answers
221 views

Is there a difference between “symmetric algorithms” and “symmetric ciphers” within the context of cryptography?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography? In reading some security exam prep material, the author seems inconsistent when ...
3
votes
1answer
515 views

Is rounds in a cryptography algorithm same as iterating the algorithm?

In a cryptography algorithm such as AES or DES, does the number of rounds mean same as iterating the algorithm? Example: c= "plaintext"; for(int i=0;i<5; i++) { c = AES(c , "key"); } Where c ...
3
votes
1answer
220 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
3
votes
2answers
535 views

Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
3
votes
2answers
91 views

Search for existence of sensitive substring without revealing substring in cleartext

I have a list of very sensitive strings and I want to ensure that these strings do not exist in a set of documents (potentially very large documents). However, these substrings are so sensitive that ...
3
votes
1answer
100 views

IPsec installed algorithms

What happens if a laptop and a server don't have a encryption algorithm in common? Does IPSec abort the connection or does it always have default algorithms?
3
votes
0answers
97 views

What is the algorithm used by Genie intellicode?

How exactly do Genie Intellicode, and other "Rolling Code" garage door openers achieve their security? A lengthy Google search didn't turn anything up, which in and of itself gives me cause for ...
3
votes
0answers
128 views

Can I make a digital time capsule? [closed]

Say I wanted to make a super awesome time capsule of some digital information. How would I encrypt it so that no one would be able to open it until a specified date? (E.g. 100 years from now.) At ...
2
votes
3answers
4k views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
2
votes
2answers
309 views

Is there such a cryptographic algorithm?

Is there such a cryptographic algorithm that will encrypt any file with a password. But when decrypting, if the password is incorrect, the file will be decrypted, but instead of relevant data there ...