Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Can a AES 256 key be recovered with the encrypted and decrypted message? [duplicate]

I have no advanced knowledge in cryptography. Is it possible to recover the AES-256 key with the decrypted and encrypted message?
0
votes
0answers
29 views

How secure is the Android Keychain

I have been able to understand the Android KeyChain API via this link. However, I want to ask how secure this API is, on the Android OS, the KeyStore is available on a cryptographic scale, but I would ...
0
votes
0answers
15 views

need help decoding [duplicate]

i am trying to decode this data but have no idea where to start. any help would be greatly appreciated 4,2,93eba2404abd4eaca468c828178cf3af,B005,167c5351,16852f43,27c,0,l6VERmVDGmY/YdIbPo5lUODp418= 4,...
0
votes
0answers
7 views

Security of Blind Signature Schemes in the Concurrent Setting [migrated]

I am quite confused about the security definition of blind signature schemes in the concurrent setting. I have found a paper as follows showing that most of the previous blind signature schemes cannot ...
0
votes
1answer
49 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
0
votes
1answer
59 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
2
votes
0answers
129 views

Why bother to generate Key, IV and encrypt them? [migrated]

When we perform encryption with Public or Private Key, Asymmetric AES with RSA and CBC 128, and when we use the padding as well. Why do we have to bother adding the additional: Key + IV? **************...
12
votes
5answers
3k views

Pseudorandom vs. True Random

Proper security algorithms demand true random numbers. For instance, secret keys & initialization vectors should never not be true random. However, generating numbers using Java's Random library ...
-1
votes
2answers
58 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
8
votes
3answers
1k views

What makes a symmetric encryption algorithm cryptographically secure?

I'm trying to learn a bit more about symmetric encryption and found out that basically every symmetric encryption and decryption is (somehow) in the end based on a simple XOR-Byte-Toggle with using a ...
0
votes
1answer
66 views

Ownership proof scheme

I'm developing a device that will require ownership proof to activate HOTP authorizations. The HOTP codes will be used in the BLE bonding between the device and the owner's phone. I came up with the ...
2
votes
4answers
185 views

SSH Server Configuration Best Practices?

I have been tasked with reviewing the settings of an SSH server, I'm currently trying to figure out what are the best practices, and I'm having a bit of trouble finding a good answer. I keep finding a ...
5
votes
1answer
174 views

Design of a web based password vault

I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
3
votes
3answers
2k views

Password based RSA encryption

I recently learned (read) the math behind RSA encryption (algorithm). Now, I wonder if there is a way to use a custom password instead of the private key. Imagine a web application, where user signs ...
0
votes
1answer
62 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
0
votes
0answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
1
vote
2answers
178 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
4
votes
1answer
81 views

Is it possible to use HKDF in the TPM?

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
2
votes
2answers
129 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
0
votes
1answer
140 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
0
votes
0answers
86 views

How secure is Identity-Based Encryption and certificateless cryptography?

The above two standards encryption schemes are used to encrypt the messages in different applications. In both cases, a trusted third party is used to create a whole encryption environment, which is a ...
0
votes
1answer
122 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
3
votes
2answers
315 views

How do companies manage & store cryptocurrency private keys?

For an individual, I see a some options for storing private keys, such as printing them on paper in a vault, using a hardware wallet, encrypting and storing on the machine, using AWS Secret Manager, ...
1
vote
1answer
160 views

Does combining a non-cryptographically secure string with a cryptographically secure string result in a cryptographically secure string?

I'm using php, but the general question applies to any confirmed cryptographically secure pseudo-random string concatenated with a non-cryptographically secure string. I know random_bytes generates a ...
1
vote
1answer
138 views

Use PBKDF2 for both authentication and decryption on NodeJS

I am using PBKDF2 on NodeJS to authenticate a user who submits username & password. To do this, when the user first registers, I generate a salt, I use 200000 iterations, I specify a key length of ...
0
votes
0answers
66 views

Correct implementation of a JWT signee

I tried implementing my own JWT logic, because I thought it would have some benefits for my use-case. Later I realized, that using the official JWT implementation is easier to use and more secure. But ...
1
vote
1answer
214 views

Why is entropy measured in bits?

I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
1
vote
1answer
165 views

Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

I read about Recommended # of iterations when using PBKDF2-SHA256? I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
0
votes
0answers
84 views

Nitro Enclave / KMS Equivalent for Google and Azure

In AWS KMS I can set a key policy on a CMK so that it can only be used from within a Nitro Enclave that either has a particular signature or a particular image hash. Is there something similar to this ...
3
votes
1answer
129 views

Role of the handshake secret (vs master secret) in TLS v1.3

In TLS v1.3, there are three secrets from which other secrets/keys are derived: early secret handshake secret master secret See this diagram. The early secret does not include the Diffie-Hellman ...
0
votes
0answers
87 views

Is using HSM worth in this scenario?

Long story short, I've assigned with the task to find a way to improve security in an application, they are using java keystores to save and protect the keys. The application owner is worried that ...
0
votes
1answer
83 views

One-way cryptographic algorithm with distinct output and verifiable property

I'm working on a API which is serving content based on user requests. What I'd like to achieve is as follows: Having a constant key stored both on the server and the client machine (as a means of ...
0
votes
2answers
157 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
1
vote
0answers
85 views

Nym Perfect Forward Secrecy

I recently heard about the Nym mixnet and am researching it and the Sphinx packet format. So far it looks promising, but there is one thing I'm unsure of. Networks like Tor use ephemeral keys to limit ...
0
votes
1answer
125 views

Combining confidentiality, authenticity and data integrity to form secure URL

There are clients (mobile application), they can share links to their profile info, which should be confidential. The link expires in 5 minutes (configured). They set Auth-Code so that the one who ...
0
votes
1answer
218 views

How to correctly convert a bit key to string for aes 256 encrytion?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(string, secret); The secret is generated through: function generateKey(str) { const salt = CryptoJS.lib.WordArray.random(128 / 8); ...
0
votes
1answer
277 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
1
vote
1answer
101 views

IV generation with RNGCryptoServiceProvider

I'm using RNGCryptoServiceProvider.GetBytes(new byte[16]) to generate IV's to use in AES (256 bits) encryption. For every record I encrypt, I generate a new IV. I'm also prepending each of these IV's ...
0
votes
1answer
85 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
2
votes
0answers
160 views

Why does OpensSSL's EVP_BytesToKey derive an IV as well as the key?

In OpenSSL EVP_BytesToKey() can be used for key derivation from a password, hash, and a number of cycles. That all makes perfect sense. The function also can take in a cipher type and salt, and ...
0
votes
1answer
108 views

Securing data stored on a file

Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user. The file should be encrypted with ...
1
vote
2answers
177 views

Where and how many times does encryption take place when we browse the internet?

I'm taking a cryptography course and what I've gathered so far is: PGP takes place at the application layer TLS takes place at the transport layer IPsec takes place in the network layer WPA2 ...
0
votes
0answers
392 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
2
votes
1answer
160 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
0
votes
0answers
109 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate? BR
0
votes
1answer
141 views

How to create a secure password for a Java keystore?

What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...
1
vote
1answer
136 views

Decrypt AAAAAAAAAAAA with vigenere [closed]

Maybe someone can help me. I have to decrypt the Vigenere Chiffre : AAAAAAAAAAAA This is all what is given. So I have no keylength or something. I think I'm not supposed to do a brute force attack. I ...
2
votes
2answers
243 views

How to securely share a secret/ password by between n individuals, so that majority consensus is required to retrieve the password / secret?

The following constraints apply cannot use physical storage medium (such as Safe/ Vault) the service used to store secret/ password should be highly available and accessible from anywhere in the ...
1
vote
0answers
117 views

Hosting the certificates from CSP in Windows Store to be visible for other applications

I am developing a CSP that performs electronic signature in the cloud and I want to use it from applications like Adobe Reader and Microsoft Word. For this, the certificates from CSP (from the cloud) ...
1
vote
1answer
305 views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...

1
2 3 4 5
46