Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

0
votes
0answers
36 views

How to determine the encoding used when you have the data not the source code

The source code converts the data as below: 00000 - 62F0CBA67EA6A2C03D399A1B06D82787CB46480370FDA0C1CF5016E59A61F0A6 000000 - F657FC2120036C2EF29AF87E4194539B1728AB2F204676E413C6FFD5970453B9 ...
0
votes
2answers
70 views

Understanding AES Keys and Passphrases

I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'. My understanding is that AES has a 128 bit block size but the key length ...
0
votes
0answers
36 views

Collision Security

Question concerning collision issue in CBC-mode: If we are using CBC mode with AES for 1 message, the birthday paradox indicates that we risk a collision after 2^(n/2) so 2^64 plaintext of 128 bits of ...
1
vote
1answer
53 views

ChaCha20Poly1305 with empty AAD

Is it safe to use ChaCha20Poly1305 with empty AAD? I tried to implement E2E encryption between two clients in network.
0
votes
0answers
45 views

Generate & secure private keys in a private network

I have seen latest mobile authentication solution where private key is generated and kept securely in a Secure Enclave/TrustZone and public key is sent to authentication server on a cloud. During User ...
0
votes
1answer
83 views

Understand the “Windows Key Store”

I work in a enterprise environment and I often hear the use of the "Windows Key Store" to store various keys including symmetric. I do understand there is a "Windows Certificate Store" which as the ...
-4
votes
0answers
32 views

How to decode this long string of decimals? [duplicate]

69299350231777143073933039096647200271721308179581238245359016367359518575223628522640775213009798215776023461621242930796666980119825788275816258161588748921874117803012120359108969918907476169787297....
1
vote
1answer
80 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
0
votes
1answer
73 views

Validating a RSA public key

A a total noob to cryptography. Situation: Given only the public_key i need to know if it is valid; in that, if i use it to encrypt say a form submission, the form data will actually be encrypted. ...
1
vote
2answers
83 views

How do you use initialization vector? [duplicate]

My application needs to store some sensitive information. I want to encrypt the data before I store it. At some point in the future, I want to be able to read and decrypt all the data. For a ...
0
votes
0answers
3 views

Ways to make white-box cryptography AES implementation more difficult to be broken [migrated]

Background: I want to use white-box cryptographic to hiding the keys stored in the client application. I am looking for existing implementations of white-box cryptography, such as AES 128 or 256. But ...
0
votes
1answer
68 views

For encrypted chat app, how can I store sent messages so that they are encrypted but still can be viewed by the sender?

Actual implimentaton will be in android but this is more about general security than actual implimentaton details. I'm making an end-to-end encrypted chat app and I know that in order to send ...
0
votes
1answer
56 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
0
votes
0answers
31 views

Is it safe to use Giphy API keys in public Github repo?

I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
0
votes
1answer
135 views

How do digital signatures work - beginner's explanation?

I'm new to cryptography, and I'm confused about digital signatures. How do they work? Please illustrate with an example in a way that a beginner can understand.
3
votes
1answer
353 views

Does revoking a certificate result in revocation of its key?

If I request my identity certificate to be revoked for any reason other than key compromise, would the private key also be revoked in result?
0
votes
2answers
1k views

Getting RSA private key from prime1, modulus and publicExponent [duplicate]

I am doing a hacking challenge but I don't manage to know how to decrypt the private key from the public key and the given private key "prime1" parameter. I've seen a private key is composed of : ...
0
votes
3answers
139 views

How is the strength of a key/Password determined

I was reading about the Principle of Key Sizes and came across this table: The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to ...
0
votes
1answer
73 views

Determine relation between many keys

I have many keys of short length (6 bytes) and I know some factors that might be used to calculate them. I know for sure that the can be obtained with the given information. Since the keys are very ...
0
votes
1answer
44 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
0
votes
1answer
61 views

How can ECDSA offer stronger security with the same key length (same amount of entropy)? [duplicate]

It's always been told that ECDSA is more secure "per bit of key size", such that it offers same security with a shorter key, or offers stronger security with the same key length. However, per my ...
2
votes
1answer
51 views

Windows BitLocker- Is the drive Password the same as the Key used by AES to encrypt the drive?

I am using BitLocker on my Win10. I encryted my usb drive using my Windows BitLocker with a strong password. I know that Bitlocker uses AES-~256 bit key for encryption. My question what is the key ...
0
votes
0answers
65 views

Converting a raw EC public key into EVP_PKEY using openssl

I am trying to convert a raw EC key and EVP_PKEY structure. The process seems straightforward but am running into issues. Here is the code I am using -- unsigned char tmpPubKey[] = { 0x04, ...
8
votes
5answers
712 views

Who SHOULD write crypto code?

I've seen a lot of questions and answers acknowledging the dangers of inventing your own crypto algorithms — and even of implementing proven algorithms yourself. And, I don't disagree. I might ...
0
votes
0answers
32 views

Protect transaction counter agains roll-back attack

I am designing a application which should be used for transaction processing so required very good performance. There are requirements that transactions originating from the same client must have ...
173
votes
12answers
23k views

Why is it wrong to *implement* myself a known, published, widely believed to be secure crypto algorithm?

I know the general advice that we should never design¹ a cryptographic algorithm. It has been talked about very extensively on this site and on the websites of professionals of such caliber as Bruce ...
0
votes
0answers
25 views

When should I use CryptoPP::AutoSeededRandomPool (not CryptoPP::NonblockingRng)?

I found CryptoPP provides several random generators: CryptoPP::AutoSeededRandomPool, CryptoPP::AutoSeededX917RNG and so on. I know some details about these generators and the usage of them, I just ...
3
votes
0answers
80 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
2
votes
1answer
92 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
3
votes
2answers
755 views

Diffie-Hellman with non-prime modulus

When using the Diffie-Hellman key-exchange, it is said to be important to use a safe prime. However, if a non-prime modulus with sufficient bit-length is generated, is there an attack that can be used ...
0
votes
1answer
86 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
1
vote
1answer
62 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
1
vote
0answers
147 views

How to crack encrypted Android SQLite DB? [closed]

I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts, How do we ensure that DB is encrypted properly and it is ...
3
votes
2answers
158 views

Feasibility of cracking a SHA256 of a UUIDv4

Given the UUIDv4 08ab4280-0043-4630-b4c7-a5393083546c which hashes to 27fd3a1ea8a58bd06cced89927fadffbb2f4815203723e5cd4ab18acbe37b659. How feasible is it to crack a SHA256 of an unsalted UUIDv4? The ...
12
votes
5answers
3k views

Are variable time comparisons always a security risk in cryptography code?

I came across the cryptography python package, and noticed it had the following about reporting security vulnerabilities: Examples of things we wouldn’t consider security issues: Using a variable ...
0
votes
1answer
117 views

I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]

Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
0
votes
0answers
39 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
5
votes
1answer
80 views

Is there a file system allowing read-only access enforced by cryptography

Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by ...
0
votes
1answer
85 views

When encrypting password hashes, how to handle nonces?

I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
2
votes
1answer
61 views

Create shared private key

Let's have the following problem: There is something like a voting application. Every participant can cast a vote. There are more than one watchers who control the election. I want to make every ...
0
votes
2answers
98 views

What factors should I consider when choosing the key for encryption and decryption?

We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java ...
0
votes
0answers
34 views

Why does ε-differential privacy protects the subset of 1/ε edges in terms of graphs?

In the book The Algorithmic Foundations of Differential Privacy by Cynthia Dwork, Aaron Roth on page 24, databases that take the form of graphs are discussed. We could on the other hand consider ...
3
votes
1answer
85 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
2answers
138 views

Is it safe to encrypt some data which contains a uuid while also sending the uuid as metadata?

I have a json data-interchange format where I send messages like the following: { "revision": { "client": "f0ede1da-7314-4e59-99f7-a3a71dcab11f", patch: ["hello world", 0] }, "client": "f0ede1da-...
1
vote
1answer
76 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
58 views

What does “probabilistic algorithm with random tape” mean?

I am new to the study of cryptography, and when reading papers they often mention that "probabilistic algorithm G with random tape w ...". What does it mean by "random tape w"? I mean why it does is ...
0
votes
0answers
178 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
46 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
0answers
61 views

iOS Security Architecture-Encryption Keys

As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave. The application processor and Secure ...
0
votes
1answer
38 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...