Questions tagged [ciphers]

In cryptography, a cipher (or cypher) is an algorithm for performing encryption or decryption—a series of well-defined steps that can be followed as a procedure. An alternative, less common term is encipherment. To encipher or encode is to convert information into cipher or code.

Filter by
Sorted by
Tagged with
0 votes
2 answers
287 views

testssl not detecting all cipher suites

I was testing the supported cipher suites for an exposed httpd service. On the server, the cipher suites are defined in the httpd properties file ( httpd.sslCipherSuite=....) When I run testssl from ...
ethicalhacker's user avatar
1 vote
2 answers
2k views

How to find and disable specific ciphers on Linux?

I have Linux servers, which was reported by IT security team having various obsolete ciphers, and I need to disable them and replace with newer versions if they used by applications. However I stumble,...
sam sergiy klok's user avatar
0 votes
1 answer
557 views

TLS1.3 using no cipher?

I received a spam text message and interrogated the domain name: $ openssl s_client -servername https://example.com -connect example.com:443 What I want to know, is how likely it is that I should see ...
sebastian o'doyle's user avatar
1 vote
0 answers
94 views

Where is the 8 byte explicit nonce for decrypting AES GCM within TLS?

I'm confused how to retrieve the remaining 8 bytes of the nonce (to combine with the 4 bytes established during the handshake) to generate the 12 byte IV to decrypt AES 128 GCM. RFC 5288 "AES ...
user997112's user avatar
0 votes
2 answers
61 views

How to pick a symmetric cipher for a given cipher text size?

I'm looking to encrypt some 64 bit integers, with a maximum cipher text size of 128bits. The encrypted numbers will be displayed in some public places, so shorter, "vanity" sizes is a ...
Carl Mastrangelo's user avatar
1 vote
0 answers
310 views

Enabling ECDH KeyExchangeAlgorithm in Windows Schannel while disabling CBC based ciphersuites

On our Windows Servers, we have disabled the following key exchange algorithms in registry SCHANNEL\KeyExchangeAlgorithms\ECDH SCHANNEL\KeyExchangeAlgorithms\PKCS This leaves us with only 2 ...
kype's user avatar
  • 111
1 vote
0 answers
65 views

Message is encrypted with RSA 1024 public key A (from pair A1-B1). What is probability to decrypt with private key from different pair (A2-B2)?

Our program encrypts the message with RSA 1024 public key A (from specific pair A-B). Then the program sends the encrypted message to the server. The server maintains a list of public-private key ...
TomR's user avatar
  • 121
1 vote
0 answers
2k views

SSLLabs' SSLTest vs. nmap ssl-enum-ciphers

Recently I conducted a SSL server test to assess the SSL configuration of my server. While the overall grade A+ was pretty good, it was found that the server supports several cipher suites that are ...
dpr's user avatar
  • 121
1 vote
1 answer
843 views

Identification of weak and anonymous ciphers with openssl

I'm doing two tests using the openssl s_client command to identify anonymous. I did two tests: One first test: I'm using the following command to anonymous ciphers: openssl s_client -cipher aNULL -...
Jhon Laurence's user avatar
0 votes
1 answer
218 views

Is key renegotiation necessary with a larger cipher in OpenVPN?

OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
Letal1s's user avatar
  • 109
0 votes
1 answer
1k views

P-384 vs. SHA384

Forgive my inexperience with encryption, I've been researching this for the better part of the morning and still cannot find a smoking gun answer. A vendor is requesting that we verify a website we ...
wr mem's user avatar
  • 1
2 votes
2 answers
294 views

Does any real world protocol makes use of the associated data in AEAD?

I'm trying to find evidence of use of the associated data (authenticated cleartext associated with the encrypted and authenticated data) feature offered by AEAD (Authenticated Encryption with ...
Bruno Rohée's user avatar
  • 5,487
1 vote
4 answers
5k views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
dawklrw's user avatar
  • 11
2 votes
2 answers
469 views

Java support for TLS_DHE_RSA_WITH_AES_128_CCM

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work....
Amal Jesudas's user avatar
4 votes
1 answer
3k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
dhanush shetty's user avatar
0 votes
1 answer
280 views

Why does `openssl ciphers -v eNULL` list `TLS_CHACHA20_POLY1305_SHA256` (and similar)?

I hope this question is on-topic: Learning about the eNULL "encryption" and the related warning, I wanted to list all ciphers than include eNULL: ~> openssl ciphers -v eNULL ...
U. Windl's user avatar
  • 163
0 votes
1 answer
731 views

Why can't you use True Random Number Generator (TRNG) to generate key stream in Stream Ciphers?

I read in the book that you cannot use True Random Number Generator (TRNG) to generate key stream in Stream Ciphers: We need some type of random number generator to derive the key stream. First, we ...
Rodion Iskhakov's user avatar
0 votes
1 answer
140 views

How does a Cipher Suite Work without an Asymmetric Algorithm? [closed]

Using the cipher suite “TLS_AES_128_CCM_SHA256” This example is referring to a self signed certificate If a server uses TLS and uses the cipher suite above? How does the certificate get signed if ...
Luke's user avatar
  • 1
0 votes
0 answers
123 views

Create a vigenere cipher encryption

I have a question about the Vigenere cipher and still do not know how to solve it. A language has an alphabet of only 4 letters with frequencies as follow: Pa=40%, Pb=20%, Pc=10% and Pd=30%. Create ...
Huy Do's user avatar
  • 1
0 votes
1 answer
416 views

Cipher, for a rookie, what's safe and not safe 2021?

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses: cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:...
JoBe's user avatar
  • 115
2 votes
0 answers
283 views

How to tell what encryption a ransomware uses

I recently was attacked by a ransomware that encrypted files in my computer and turning them into a .CRYSTAL file type. In the ransom note there is a “key id” which resembles a public key of sort, and ...
40pro's user avatar
  • 121
1 vote
0 answers
931 views

What is the relation between cipher suite and certificate? [duplicate]

I generated my self signed certificate using openssl and I chose ECC keys (prime 256v1) for root certificate but while authenticating with the server i.e. IBM cloud and my device the negotiated cipher ...
wanglen soram's user avatar
27 votes
4 answers
4k views

Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
matthias_buehlmann's user avatar
2 votes
0 answers
287 views

Best resource to verify weak cipher suites [closed]

Many tools enable to list accepted ciphers but not all of them verify if these ciphers are secure. For example, Nmap with script ssl-enum-ciphers ranks some ciphers as secure even though actually this ...
user187205's user avatar
  • 1,293
2 votes
1 answer
794 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
HCSF's user avatar
  • 153
0 votes
1 answer
139 views

Site use weak cipher and TLS older version

I just tested a site and it looks like the certificate uses weak ciphers but the certificate is new. Can this issue be related to the Certification Authority that provides the certificate? Or this ...
Ion Stirba's user avatar
6 votes
3 answers
5k views

Qualys SSL Scan weak cipher suites which are secure according to ciphersuite.info

I am testing my application SSL configuration in Qualys SSL Labs and as a result, I have this cipher suites labeled as weak: But according to https://ciphersuite.info/ all of these cipher suites are ...
user187205's user avatar
  • 1,293
1 vote
1 answer
3k views

Is it possible to crack a laptop's encrypted hard disk?

In a talk about a lost or stolen laptop, it is said that: even with hard drive encryption, eventually they can crack these secrets But strong encryption is practically impossible to break. For ...
stevec's user avatar
  • 1,260
0 votes
1 answer
717 views

Did The Wire invent the "Jump 5" cipher?

N.B. Asking this here instead of Movies.SE because I'm wanting to know about the cipher itself and any history, which this site is more suitable for. In S01E05 of The Wire, at around 45:00, it's ...
Hashim Aziz's user avatar
0 votes
1 answer
448 views

Help identify a simple, reversible cipher/encryption algorithm [duplicate]

I'm trying to help a small business transition out of an obsolete, obscure piece of software, and app support is, unfortunately, non-existent. To fully export the data for the new system, I need to be ...
mindofsound's user avatar
0 votes
0 answers
96 views

TLS client does not drop connection even when there are no suitable ciphersuites in the server ciphersuite list during handshake

I have two Windows systems, and I want to establish an encrypted TCP/IP communication between them. Specifically TLS 1.2 or TLS 1.3. I have configured in both systems the list of allowed ciphersuites: ...
Silverman's user avatar
  • 101
-1 votes
3 answers
1k views

how do i find the number of possible keys / password to decrypt a plain text

I would like to know if there is any way to recover the plain-text of a message that's been encrypted with 55 rounds of the Caesar cipher, with a different (independently chosen) key for each round; I ...
caroline's user avatar
2 votes
2 answers
3k views

OpenSSH: Meaning of cipher with email address @openssh.com

When using OpenSSH server (sshd) we specify allowed ciphers, host key algorithms and MACs. Some of those ciphers have an email address appended, for example [email protected] as opposed to aes256-...
TheCooocy's user avatar
  • 123
0 votes
2 answers
1k views

Remove less secure ciphers from WHM by decrpyting different convoluted references to the same ciphers

I have previously removed less secure ciphers from WHM (Web Host Manager) however it has been a while and I want to learn how to fish, not be handed a fish. The trouble seems to stem from the fact ...
John's user avatar
  • 119
12 votes
2 answers
2k views

Why is the BCrypt text "OrpheanBeholderScryDoubt"

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
wim's user avatar
  • 663
1 vote
1 answer
307 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
Michael Altfield's user avatar
4 votes
1 answer
6k views

What is the difference between "cipher" and "encryption"?

It seems as if they are either synonyms, or cipher was an older term for when they directly translated the same number (or almost same number) of "encrypted" characters into the same number of ...
Dariell's user avatar
  • 51
0 votes
3 answers
294 views

How would anyone ever break even this basic, amateurish cipher/encryption scheme?

This question was prompted by a long Wikipedia session with me reading tons of articles on cryptography, causing far more questions than it answered. Let's say that I and another person know each ...
Curren's user avatar
  • 1
0 votes
1 answer
296 views

What exactly was "'dotty' and 'dashy'" Morse code?

During early World War I (1914–1916), Germany briefly experimented with 'dotty' and 'dashy' Morse, in essence adding a dot or a dash at the end of each Morse symbol. Each one was quickly broken by ...
Deric's user avatar
  • 11
1 vote
0 answers
2k views

Disable vulnerable cipher suites

As a part of my learning, I installed OpenVAS into one of our Ubuntu test servers and scan the said server. I have the results and I wanted to remediate the findings as part of my learning the Linux ...
Finn's user avatar
  • 13
1 vote
1 answer
953 views

Why does the NodeJS Crypto docs use CBC instead of GCM for RSA key-pair?

I have read that GCM is almost always more secure than CBC when implemented correctly. However, in the documentation of NodeJS, CBC is being used as an example instead. The key-pair will be stored ...
isopach's user avatar
  • 511
2 votes
2 answers
1k views

What if the attacker tamper the IV used in the block cipher CBC mode?

I am a newbie to block cipher and when learning the CBC mode, I start to understand that an IV is being used in this mode and also will be transferred to the message receiver. So here is my question,...
lllllllllllll's user avatar
0 votes
1 answer
310 views

TLS key exchange and certificate subject public key clarification

This question is similar to this one, so let me elaborate what I'm struggling with. I want to get the length/strength of the key used by the server during the key exchange and authentication, i.e. ...
superuser's user avatar
0 votes
0 answers
663 views

Openssl using the cipher parameter result in handhsake failure

When i use Openssl to connect to facebook.com I see 'ECDHE-ECDSA-AES128-GCM-SHA256' ciphersuite used. openssl s_client -connect www.facebook.com:443 SSL handshake has read 3280 bytes and written 373 ...
Redhat's user avatar
  • 13
0 votes
0 answers
146 views

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication? [duplicate]

Can someone explain the significance of Certificate Signature algorithm in the selection of Cipher suite in a TLS communication?
Redhat's user avatar
  • 13
2 votes
1 answer
624 views

3DES supported in application although disabled in Windows

Can users actually use the 3DES cipher to connect to a Tomcat web server, if the 3DES cipher has been disabled via registry keys in Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\...
QuantumSec's user avatar
0 votes
0 answers
34 views

Help me to identify what type of string it is? [duplicate]

70373f65f945e5184dcb42793cbe2cddb34248ef172b7ddb5e27467fd8d76314ea8bdeb19226687ac0ca01e646dbe8fdb4dfb2d6816f54b9b500639ac6c3bf056fbd4c45a246bbe66e6fd0ce3730801716b12fff942207933e1bb6386806d476ade6f5b1 ...
user avatar
1 vote
1 answer
6k views

How do I get the list of cipher suites supported in a specific TLS version?

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
Mo Haidar's user avatar
  • 439
0 votes
1 answer
1k views

Deciphering ciphertext with an unknown key and algorithm [closed]

How can I get started on understanding how to decipher this ciphertext when I don't know the algorithm or key used? TDcbY xqCa NeAA OsWMirK FNFOm bYRUYAkxl,  tqwl  axZU  XTaLrBSFv OI G vWjBZyqhz.  ...
user210845's user avatar
2 votes
2 answers
3k views

Is there any CBC based ciphersuite which are secure for known attacks like LUCKY13?

If you select the modern profile in https://mozilla.github.io/server-side-tls/ssl-config-generator/ , you can see it recommends to enable following four cipher suites also. ECDHE-ECDSA-AES256-SHA384 ...
Manjula's user avatar
  • 180