Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
2
votes
1answer
88 views

What does this Bruce Schneier fact mean?

I came across a website called Bruce Schneier Facts, a parody along the lines of Chuck Norris facts, and saw the following fact: Schneier knows if Reiser did it. What does it mean?
-1
votes
0answers
36 views

Penetration testing Padding oracle vs POODLE

I am doing pen-test according to https://www.owasp.org/images/1/19/OTGv4.pdf. I would like to ask you about Padding oracle attack. Is attack "POODLE" the same as Padding oracle in this document? On ...
0
votes
0answers
102 views

Most efficient way to break md5? [migrated]

if you know the result of a hash, for this example the resulting hash is: ec664d1d65fd8a58c59b337b11c37a4d And you also know the hash has been made like this: const salt = "asdjbsdhal" const ...
0
votes
3answers
103 views

Encrypt Different Users with unique keys

I have a database that I want to implement an encryption per x amount of users. Say I have 1000 Users in the database and I wanted every 1000 encrypted differently then I would generate a new key and ...
1
vote
2answers
76 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
0
votes
0answers
53 views

Find a regex pattern from a secret [closed]

I have a secret that looks like as follow c2b47f2d-4b5d-3a4c-a337-5d2a41212dc3 My goal is to find any algorithm or any pattern which is used to generate such a secret. Could someone give some hints ...
0
votes
3answers
54 views

Can the username be used in HMAC during client-side hashing?

I am very new to authentication and cybersecurity in general, so I apologize if I have anything completely wrong. My goal is to have the client side hash passwords before sending them to server side ...
-3
votes
0answers
62 views
0
votes
1answer
39 views

Why rijndael.key value is different with rijndael.iv?

someone can tell me how rijndael works? for now i need to handle key and iv generated from C# (using rijndael + rfc2898derivebytes) to match with CryptoJS code snippet of C#: byte[] saltArray = ...
0
votes
0answers
37 views

I found this easter egg, any ideas what kind of encryption it is? [duplicate]

I am looking to have the cryptography identified of this encrypted message aHR0cHM6Ly9nb28uZ2wvZXY5SDN1 Any ideas what crypto was used here? Thank you
-1
votes
0answers
38 views

ISO 9564 PIN block purpose [closed]

In financial transactions, according to ISO 9564, PIN block is generated using cardholder PIN, based on ISO formats and finally the PIN block is encrypted and sent to the issuer. Why we are framing ...
0
votes
2answers
96 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
0
votes
1answer
29 views

How to encrypt user data in app using Google Sign-In

I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way ...
2
votes
1answer
78 views

SSH Public Key / Host Key - Can Client Request Key Length?

In SSH, does the client have any power in determining the key size of the host key, or is it completely dependent on what the servers host key is? For instance, say the client and server agree on ...
0
votes
0answers
46 views

Does Windows CNG Keystore support exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
7
votes
2answers
1k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
1
vote
2answers
81 views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
2
votes
1answer
118 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
2
votes
1answer
67 views

RSA key size in TLS ciphersuite with RSA key exchange

I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits) I understand that the RSA algorithm is used here for for key exchange, as ...
2
votes
1answer
119 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
-1
votes
2answers
50 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
1
vote
2answers
86 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
0
votes
0answers
28 views

How to customize default enabled EC curves or the curves preference in Azul Zulu JDK

We use Zulu JDK and want to customize the default enabled EC curves. Oracle JRE provides this using jdk.tls.namedGroups system property in java.security. https://www.oracle.com/technetwork/java/...
0
votes
1answer
56 views

Updating Sender-Keys and Key-Management

This question is related to an earlier question I had: Encryption on Mobile Devices - Multiparty Encryption - Key Management My situation: I have many mobile devices that want to send sensitive ...
1
vote
1answer
82 views

Digital Footprint Law

Can anyone help me with the name of the digital footprint law? All I know is that it is named after its discoverer much like Moore's Law is. This is a computer science law that states for the purposes ...
2
votes
1answer
76 views

Is getting 1-2 outputs from a CSPRNG to seed another CSPRNG less entropy than getting say 5000 outputs from a CSPRNG and using that to seed?

This question builds off of this question. I want to create more entropy from a viable entropy source to seed another CSPRNG. If I use window.crypto.getRandomValues(newUint8Array(1)) To seed a ...
-1
votes
1answer
36 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
1
vote
1answer
104 views

Encryption on Mobile Devices - Multiparty Encryption - Key Management

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
0
votes
1answer
68 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
8
votes
1answer
293 views

How are Mozilla Firefox passwords encrypted?

As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions). ...
1
vote
2answers
64 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
3answers
87 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
1
vote
1answer
90 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
0
votes
0answers
45 views

Public blockchain, encrypted blocks with access list; Key revocation; Is it a fit for attribute based cryptography?

I've got the requirement to put the company data onto blockchain for traceability and auditability. Some of that data is public, whilst some of this data is confidential to 1+ (could be many) user ...
0
votes
0answers
32 views

Help me to identify what type of string it is? [duplicate]

70373f65f945e5184dcb42793cbe2cddb34248ef172b7ddb5e27467fd8d76314ea8bdeb19226687ac0ca01e646dbe8fdb4dfb2d6816f54b9b500639ac6c3bf056fbd4c45a246bbe66e6fd0ce3730801716b12fff942207933e1bb6386806d476ade6f5b1 ...
1
vote
1answer
90 views

Would Hashing a Decryption Key Significantly Lower Security? [duplicate]

I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
2
votes
3answers
167 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
2
votes
2answers
101 views

How to protect data integrity in IoT network? [closed]

The security of IoT devices is very important to protect the data uploaded by IoT devices. Because if an attacker force an IoT device to upload misleading/false data, the analytics and insights ...
0
votes
0answers
96 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
1answer
83 views

Find seed used in Math.random LCG given a list of outputs [duplicate]

Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is ...
0
votes
2answers
144 views

How do you use a public key to encrypt a string

I am oversimplifying but I understand that a public key is the product of two large prime numbers. In essence as long as the private key is kept private, the owner knows something that the outside ...
0
votes
1answer
58 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
0
votes
0answers
41 views

CSP/KSP module for MacOS

My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service. I would like to know if there is support ...
0
votes
3answers
87 views

Is it possible to build a partial search mechanism on hashed values? [closed]

I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt. For now, things look good. I have the hashes ...
0
votes
1answer
44 views

Should i upgrade old volumes to new cryptsetup encyption mode?

old cryptsetup default is es-cbc-essiv:sha256. the new one is aes-xts-plain64:sha256. i don't know that much about cryptography but i assume the standard was changed for a reason. also there can be ...
-2
votes
1answer
126 views

What is ECC / HECC, how does it differ from asymmetric encryption?

I'm relatively new to cryptography, and I would like to know what Elliptic Curve Cryptography and Hyper Ellipic Curve Cryptography (HECC) are, and where they are intended to be used. I have read ...
0
votes
1answer
120 views

Deciphering ciphertext with an unknown key and algorithm [closed]

How can I get started on understanding how to decipher this ciphertext when I don't know the algorithm or key used? TDcbY xqCa NeAA OsWMirK FNFOm bYRUYAkxl,  tqwl  axZU  XTaLrBSFv OI G vWjBZyqhz.  ...
0
votes
0answers
40 views

How ECDH Implement in Microservices

I have a problem when I want to encrypt decrypt data by use the same key in every services.I use ECDH Method to encrypt decrypt data between client and server. I have a exchangeKey service to gen Key ...
0
votes
0answers
43 views

Convert openssl private key to openssh private key [duplicate]

I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh formatted private key using ssh-keygen.I have ...
0
votes
0answers
62 views

How to determine the encoding used when you have the data not the source code [duplicate]

The source code converts the data as below: 00000 - 62F0CBA67EA6A2C03D399A1B06D82787CB46480370FDA0C1CF5016E59A61F0A6 000000 - F657FC2120036C2EF29AF87E4194539B1728AB2F204676E413C6FFD5970453B9 ...