Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
1answer
23 views

Is NSA disclosure of CRYPT32 vulnerability a charitable public service? [closed]

News coverage of this makes it sound like the NSA is mending fences and helping us all out, kindly and heroically. I have nothing against the NSA but isn't it more likely an adversary has been ...
1
vote
2answers
51 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
0
votes
0answers
4 views

Scrypt KDF cipher - known vulnerabilities and cryptanalysis? [migrated]

There is a scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heard of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
0
votes
0answers
30 views

Determine the type of encryption used [duplicate]

I am trying to determine the type of encryption used for a site whose password is stored in the database. The site is built using the fuelphp. It has the password of the form (...
3
votes
1answer
126 views

Database Security - Encryption & Searching

I am completely new to cryptography but have been trying to make myself familiar with the concepts and applications. I have a project where I believe cryptography to be beneficial. Project Info: DB =...
1
vote
0answers
110 views

Why does a nonce prevent a replay attack? [migrated]

I have a question about a cryptographic nonce. I understand the use of a nonce, however there is one particular part that I don't understand. Please consider the picture below. I don't really ...
2
votes
3answers
154 views

How can one test if a password generator is cryptographically secured?

Given the plethora of random password generators (RPG) available, I'd like to do some black box testing on some. Let's take https://passwordsgenerator.net/ for example. Assuming the whole generator ...
0
votes
1answer
39 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
-2
votes
0answers
46 views

What makes a cryptographic hash different from a “normal” hash? [duplicate]

There are 2 types of hash: the normal hash and the cryptographic hash. As I see the only difference between these is that the cryptographic hash is more resistant to collisions and aims to guarantee a ...
0
votes
1answer
38 views

How to compare hashes with bcrypt when the salt is different?

There are different ways to perform a MAC, but without doubt the most used and efficient in many cases is HMAC, this serves to verify that the message has not been altered. A hash such as sha-256, sha-...
0
votes
0answers
8 views

Crack LCG given 2 output values only [migrated]

I want to try to break an LCG generator just as programming practice task. I found similar issue at Cracking a linear congruential generator. Assume that m is given. The answer to the link above ...
5
votes
3answers
710 views

How can I find a SHA-256 hash with a given suffix using hashcat?

Recently we competed in the X-MAS 2019 CTF and many of the challenges included a proof of work (PoW) check to avoid Denial of Service (DoS) attacks against their servers. The most common was we were ...
0
votes
0answers
7 views

AES Key Derivation algorithm [migrated]

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
0
votes
2answers
163 views

Security risk of encrypting the same data with many public keys

I need to distribute a shared 256 bit key to 100's or 1000's of nodes (I have the public key of each node). There's no networking involved - this will all be done by loading a single file on to ...
0
votes
0answers
41 views

Can anyone identify the authentication backend used by a PHP website from the following URL?

Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path: https://phpwebsite.com/login/auth/[encoded_data] where encoded_data is either 811, or 726 ...
18
votes
4answers
9k views

How long should a hash be to be absolutely secure?

Is there some sort of rule to determine how large a hash should be to ensure the security (meaning exactly one message maps to a given hash) of a message? Something that can be applied to any message,...
10
votes
2answers
2k views

The maximum size of a file that I can encrypt with a specific key size

a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command. we extract the public key from the private key using the command openSSl rsa -in privatekey.pem -pubout -...
1
vote
1answer
39 views

Signing webhooks: symmetric vs asymmetric

I want to sign webhooks so that client services can verify that a request came from my service. Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously,...
5
votes
1answer
129 views

Alternatives to cryptographic signatures

I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message). The messages ...
38
votes
6answers
9k views

Schemes/ Mechanisms that could provide one time decryption?

I am quite familiar with most of the common undergrad/grad security foundations; but I couldn't find anything related to this scenario: A scheme/system where a piece of data can only be 'decrypted' ...
5
votes
1answer
124 views

Is FeliCa DES encryption safe?

Sony FeliCa does not provide any official docs on which cryptographic functions are used for their NFC cards. They got some docs explaining that they do mutual authentication, but there is no official ...
1
vote
1answer
15 views

How Digital Certificate is bound to a perticular identity?

I'm trying to understand the following: Lets say Alice wants to encrypt a message with the public key of bob. There can be a man-in-the-middle attack who impersonates bob. So we uses digital ...
2
votes
2answers
86 views

Should I chunk or not for AES-GCM file encryption

New to file encryption. Need to use AES-GCM for file encryption, can't change the alg. Heard about the max plain text size should be 64GB with same key and IV pair. Environment is python 3 with ...
1
vote
1answer
78 views

Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?

The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
1
vote
0answers
20 views

determine type of encoding/encryption [duplicate]

Is there a way to find out what type of encryption is being used on this data? I was playing around with a game data and i cant get around it . This Is the data im trying to decrypt, any help? Code: ...
2
votes
0answers
64 views

What's on Applied Cryptography? [closed]

Just wondering what is the story behind the front cover image of Schneier's Applied Cryptography book https://www.schneier.com/books/applied_cryptography/ Who is the author? Is it some famous picture ...
0
votes
1answer
88 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
2
votes
1answer
164 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
1
vote
2answers
204 views

Can anyone give feedback on this encryption program? [closed]

I am 14 years old and I have just created an encryption program with a friend. I wanted to know if anyone here could give me back any feedback on it. Here is how the program works, Imagine you want ...
1
vote
0answers
76 views

Outcome of Needham-Schroeder protocol

I am studying Needham-Schroeder protocol in my course subject and I understood it well, but there is a homework problem which is asking, "what is the outcome of Needham-Schroeder protocol?" ...
2
votes
3answers
160 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...
1
vote
0answers
40 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
0
votes
0answers
36 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
1answer
95 views

WEP cracking - Why does many IVs allow to actually get the cipher key [duplicate]

I've been reading a lot about WEP cracking on online resources very recently, however there is one question that no website gives answer to I believe. I would like to first understand the theory very ...
0
votes
0answers
57 views

Password authentication using a master key and KDF without storing password

I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user. What I'm considering is using key derivation function with a shared master ...
0
votes
1answer
72 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
4
votes
1answer
119 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
1
vote
5answers
199 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
1answer
159 views

What does this Bruce Schneier fact mean?

I came across a website called Bruce Schneier Facts, a parody along the lines of Chuck Norris facts, and saw the following fact: Schneier knows if Reiser did it. What does it mean?
0
votes
3answers
113 views

Encrypt Different Users with unique keys

I have a database that I want to implement an encryption per x amount of users. Say I have 1000 Users in the database and I wanted every 1000 encrypted differently then I would generate a new key and ...
2
votes
3answers
190 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
0
votes
3answers
63 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
0
votes
1answer
62 views

Why rijndael.key value is different with rijndael.iv?

someone can tell me how rijndael works? for now i need to handle key and iv generated from C# (using rijndael + rfc2898derivebytes) to match with CryptoJS code snippet of C#: byte[] saltArray = ...
0
votes
0answers
39 views

I found this easter egg, any ideas what kind of encryption it is? [duplicate]

I am looking to have the cryptography identified of this encrypted message aHR0cHM6Ly9nb28uZ2wvZXY5SDN1 Any ideas what crypto was used here? Thank you
0
votes
2answers
109 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
0
votes
1answer
38 views

How to encrypt user data in app using Google Sign-In

I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
2
votes
1answer
86 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
81 views

Does Windows CNG Keystore support exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
8
votes
2answers
1k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
1
vote
2answers
378 views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...