Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

1
vote
0answers
41 views

How the decryptor author found the initialization vector for the AES CBC- whatsapp CRYPT5 db uses?

I was going through DECIPHERING MSGSTORE.DB.CRYPT5, THE NEW DATABASE WHATSAPP & Steal WhatsApp update. The author of the first link published a decryptor which sets the iv for the aes_192_cbc to ...
1
vote
0answers
30 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
1answer
24 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
1
vote
1answer
50 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
0
votes
0answers
46 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
3answers
97 views

Decrypting Engima messages

Not really computer related, but I hope someone has the answer. How do people decode messages from an Enigma machine? I understand that if you knew the rotors, rotor positions, and plugboard the ...
4
votes
2answers
216 views

Is crypto.js vulnerable to heartbleed attack? [duplicate]

We are using 'crypto.js' in our application. Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack? If yes, what can we do to prevent it?
1
vote
3answers
108 views

Cryptosytem Question

A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails ...
0
votes
1answer
61 views

Cryptographic Hash function [closed]

How can I implement a cryptographic hash function using the block cipher? I was wondering whether I can use AES in cipher block chaining mode to achieve this.
3
votes
1answer
58 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
4
votes
1answer
121 views

How would you know a certificate/private key if you extracted it from RAM? Or would you?

Related to, of course, the heartbleed vulnerability, I've been reading the news about the worst case scenario for this attack being the extraction of the SSL private key, because, of course, this ...
1
vote
1answer
137 views

How does CryptoDefense ransomware encrypt large data with a (relatively) small RSA key?

I recently encountered some news about the recently new Ransomware called CryptoDefense: it uses RSA 2048 to encrypt your valuables and offers the private key for a price. (It's already been solved ...
4
votes
1answer
57 views

Recommended symmetric key usage period

Let's assume that there are two nodes A and B connected over a network. Both have a single pre-shared symmetric key (e.g., AES-128) and exchange messages. What is the recommended period, until the ...
1
vote
1answer
54 views

What is default mode for AES encryption [closed]

What will be the default mode for AES encryption if we don't use any specific mode like ECB, CBC, OFB, CTR, etc. and just carry out the encryption without specifying any AES encryption mode.
1
vote
2answers
91 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
1answer
58 views

Get PGP Private Key from RAM analysis RSAKeyFind

For an experiment, I'm trying to open a 2048-bit RSA encrypted mail on a image. Using this fresh image, I made a memory dump and analysed the dump for RSA keys. Now, several RSA keys have been ...
2
votes
1answer
145 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
0
votes
0answers
50 views

Utilizing PBKDF2 With OpenSSL crypto library [migrated]

I want to utilize the PBKDF2 algorithm with SHA1 HMAC (based on this answer). How can I utilize this through the crypto library? I started by looking at man openssl, but the openssl passwd command ...
3
votes
2answers
109 views

What does the “period” of a random number generator measure?

What is "period" in the context of pseudo-random number generators? For example when someone says "The Mersenne Twister has a 2^19337−1 period" what does it mean? I would appreciate a simple as ...
0
votes
2answers
30 views

What are some examples of a block cipher's versatility over a stream cipher?

I understand that a block cipher can be made to act like a stream cipher at the cost of "losing versatility" of the block cipher for the sake of performance. I don't understand what I'd be losing. ...
-1
votes
1answer
59 views

Current Encryption Algorithms? [closed]

What are some encryption algorithms that are currently in use by secure websites, by operating systems, or by Secure USB thumb drive manufacturers. I am trying to do research on differences in speed ...
-1
votes
4answers
137 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
1
vote
1answer
46 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
1
vote
1answer
50 views

Need help designing an encryption workflow

Background: I'm building a .NET application, a very small part of this application allows for users to communicate with a third party application. I am designing this aspect. The third party simply ...
2
votes
1answer
63 views

Better than brute-force way to find the “lowest” sha1 hash?

While pointing out a SQL injection flaw on another question, I was able to show that an arbitrary sha1 hash could be inserted into a query such that it would be taken for a real hash, and was ...
1
vote
0answers
38 views

Is it possible to produce incorrect Metadata?

There is an app on xposed installer called XPrivacy for android that let's you decide what information you want your device to give a specific app and for information you don't want to give it ...
2
votes
1answer
59 views

Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?

note: Title edited to make the answer more useful to a wider audience I'm reading source code for encrypting files with AES GCM and see the following binary output. AdditionalAuthData IV ...
2
votes
1answer
122 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
0
votes
2answers
87 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
2
votes
1answer
53 views

Avoiding Replay Attacks on Lightweight Channel

I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity). The controllers will be receiving commands from a central system over these ...
15
votes
3answers
401 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
1
vote
1answer
73 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...
1
vote
3answers
99 views

How encryption/decryption works when one generate random key?

I am new to this and want to ask a basic question.Suppose I used my password (say "ABC123") to generate a key using PBKDF2 algorithm (or any such algorithm).For encrypting a file I'll input my ...
12
votes
4answers
554 views

Why are there few (none?) easy to use encryption libraries?

If I search stack overflow for how to safely encrypt data, one of the first hits is someone's custom encryption scheme. I've seen several similar questions on this site, and in general they are all ...
0
votes
1answer
71 views
0
votes
1answer
63 views

two encrypting / hashing case, which one is best

Thinking about these below two cases, which one is best and most secure one 1st case //key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
3
votes
3answers
103 views

Can RSA keys be swapped?

On a theoretical level, is there anything inherently different about public vs private keys? During RSA key generation there are two keys generated, key A and key B. Key A is private and Key B is ...
0
votes
2answers
113 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
88 views

is this code valid for securing passwords? [duplicate]

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure $pass='test'//the password ...
0
votes
1answer
56 views

Theoretical key encryption question

I have a question regarding encryption and message sending. There are 2 hosts, A and B with their own secret key kA and kB (assuming this is not PKI). It is known that when A wants to send a message ...
1
vote
3answers
253 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
95
votes
7answers
6k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
0
votes
1answer
116 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
1answer
44 views

Frequency Analysis [closed]

I have started looking into Crytography, and the obvious starting point is frequency analysis. As a task for myself I thought it would be good to compile a script which could be used for perform the ...
1
vote
1answer
48 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
2
votes
0answers
35 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? [duplicate]

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
5answers
114 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
71 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
1
vote
3answers
297 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
3
votes
1answer
52 views

Are there any fast Homomorphic Obfuscuation techniques available?

Assuming that cryptography falls into one of three areas: Awfully weak protocols and algorithms, that are trivial to break with a low amount of effort and resources Cryptographically strong ...