Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
19
votes
4answers
9k views

How long should a hash be to be absolutely secure?

Is there some sort of rule to determine how large a hash should be to ensure the security (meaning exactly one message maps to a given hash) of a message? Something that can be applied to any message,...
9
votes
3answers
2k views

The maximum size of a file that I can encrypt with a specific key size

a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command. we extract the public key from the private key using the command openSSl rsa -in privatekey.pem -pubout -...
0
votes
1answer
30 views

Signing webhooks: symmetric vs asymmetric

I want to sign webhooks so that client services can verify that a request came from my service. Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously,...
5
votes
1answer
121 views

Alternatives to cryptographic signatures

I have a program I am developing and am currently using ed25519 to cryptographicaly sign messages. However, even those signatures are longer than I would like (64 bytes + the message). The messages ...
32
votes
6answers
6k views

Schemes/ Mechanisms that could provide one time decryption?

I am quite familiar with most of the common undergrad/grad security foundations; but I couldn't find anything related to this scenario: A scheme/system where a piece of data can only be 'decrypted' ...
0
votes
0answers
5 views

How to load openssh private key using cryptography python module? [migrated]

I am getting ValueError("Could not deserialize key data.") if I use load_pem_private_key from from cryptography.hazmat.primitives.serialization
5
votes
1answer
108 views

Is FeliCa DES encryption safe?

Sony FeliCa does not provide any official docs on which cryptographic functions are used for their NFC cards. They got some docs explaining that they do mutual authentication, but there is no official ...
0
votes
1answer
12 views

How Digital Certificate is bound to a perticular identity?

I'm trying to understand the following: Lets say Alice wants to encrypt a message with the public key of bob. There can be a man-in-the-middle attack who impersonates bob. So we uses digital ...
1
vote
2answers
70 views

Should I chunk or not for AES-GCM file encryption

New to file encryption. Need to use AES-GCM for file encryption, can't change the alg. Heard about the max plain text size should be 64GB with same key and IV pair. Environment is python 3 with ...
1
vote
1answer
71 views

Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?

The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
1
vote
0answers
20 views

determine type of encoding/encryption [duplicate]

Is there a way to find out what type of encryption is being used on this data? I was playing around with a game data and i cant get around it . This Is the data im trying to decrypt, any help? Code: ...
2
votes
0answers
62 views

What's on Applied Cryptography? [closed]

Just wondering what is the story behind the front cover image of Schneier's Applied Cryptography book https://www.schneier.com/books/applied_cryptography/ Who is the author? Is it some famous picture ...
0
votes
1answer
78 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
2
votes
1answer
160 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
1
vote
2answers
201 views

Can anyone give feedback on this encryption program? [closed]

I am 14 years old and I have just created an encryption program with a friend. I wanted to know if anyone here could give me back any feedback on it. Here is how the program works, Imagine you want ...
1
vote
0answers
71 views

Outcome of Needham-Schroeder protocol

I am studying Needham-Schroeder protocol in my course subject and I understood it well, but there is a homework problem which is asking, "what is the outcome of Needham-Schroeder protocol?" ...
2
votes
3answers
146 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...
1
vote
0answers
39 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
0
votes
0answers
36 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
1answer
70 views

WEP cracking - Why does many IVs allow to actually get the cipher key [duplicate]

I've been reading a lot about WEP cracking on online resources very recently, however there is one question that no website gives answer to I believe. I would like to first understand the theory very ...
0
votes
0answers
56 views

Password authentication using a master key and KDF without storing password

I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user. What I'm considering is using key derivation function with a shared master ...
0
votes
1answer
65 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
4
votes
1answer
108 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
1
vote
5answers
188 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
1answer
153 views

What does this Bruce Schneier fact mean?

I came across a website called Bruce Schneier Facts, a parody along the lines of Chuck Norris facts, and saw the following fact: Schneier knows if Reiser did it. What does it mean?
0
votes
3answers
113 views

Encrypt Different Users with unique keys

I have a database that I want to implement an encryption per x amount of users. Say I have 1000 Users in the database and I wanted every 1000 encrypted differently then I would generate a new key and ...
2
votes
3answers
158 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
0
votes
3answers
62 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
0
votes
1answer
48 views

Why rijndael.key value is different with rijndael.iv?

someone can tell me how rijndael works? for now i need to handle key and iv generated from C# (using rijndael + rfc2898derivebytes) to match with CryptoJS code snippet of C#: byte[] saltArray = ...
0
votes
0answers
39 views

I found this easter egg, any ideas what kind of encryption it is? [duplicate]

I am looking to have the cryptography identified of this encrypted message aHR0cHM6Ly9nb28uZ2wvZXY5SDN1 Any ideas what crypto was used here? Thank you
0
votes
2answers
106 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
0
votes
1answer
35 views

How to encrypt user data in app using Google Sign-In

I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
2
votes
1answer
81 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
68 views

Does Windows CNG Keystore support exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
8
votes
2answers
1k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
1
vote
2answers
245 views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
2
votes
1answer
122 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
2
votes
1answer
78 views

RSA key size in TLS ciphersuite with RSA key exchange

I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits) I understand that the RSA algorithm is used here for for key exchange, as ...
2
votes
1answer
129 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
-1
votes
2answers
53 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
1
vote
2answers
150 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
0
votes
0answers
33 views

How to customize default enabled EC curves or the curves preference in Azul Zulu JDK

We use Zulu JDK and want to customize the default enabled EC curves. Oracle JRE provides this using jdk.tls.namedGroups system property in java.security. https://www.oracle.com/technetwork/java/...
0
votes
1answer
60 views

Updating Sender-Keys and Key-Management

This question is related to an earlier question I had: Encryption on Mobile Devices - Multiparty Encryption - Key Management My situation: I have many mobile devices that want to send sensitive ...
1
vote
1answer
85 views

Digital Footprint Law

Can anyone help me with the name of the digital footprint law? All I know is that it is named after its discoverer much like Moore's Law is. This is a computer science law that states for the purposes ...
2
votes
1answer
81 views

Is getting 1-2 outputs from a CSPRNG to seed another CSPRNG less entropy than getting say 5000 outputs from a CSPRNG and using that to seed?

This question builds off of this question. I want to create more entropy from a viable entropy source to seed another CSPRNG. If I use window.crypto.getRandomValues(newUint8Array(1)) To seed a ...
-1
votes
1answer
55 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
2
votes
1answer
111 views

Encryption on Mobile Devices - Multiparty Encryption - Key Management

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
0
votes
1answer
71 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
8
votes
1answer
414 views

How are Mozilla Firefox passwords encrypted?

As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions). ...
1
vote
2answers
78 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...