Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

0
votes
2answers
50 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
0
votes
0answers
34 views

Retaining control of a document one released

This is a total noob question and is more about technical feasibility and in short is basically a question of - "can i solve piracy" but humour me. Below is a scenario, with the case study of a film. ...
1
vote
1answer
95 views

Authenticate that I am the poster of a certain anonymous message

I'm a programmer, and I've made a nifty script that scours a certain internal forum site. Messages posted on the forum are all anonymous, so I'm wondering how exactly I can get my script to realize ...
-3
votes
0answers
48 views

Advice related to Masters in Cybersecurity [closed]

I am an Undergraduate pursuing Bachelors in Computer Science and Engineering with specialization in Cloud Computing and Virtualization. I have plans to pursue Masters in the field of Cybersecurity ...
1
vote
0answers
36 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
8
votes
4answers
146 views

How much security expertise does a general application programmer need to develop software ethically? [closed]

I am curious about this. I saw this thread: Why shouldn't we roll our own? and this answer: https://security.stackexchange.com/a/18198/144241 which had on it this comment, which had the second ...
1
vote
1answer
47 views

Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?

Situation as follows: Let's assume two (or more) containers, encrypted using the same passphrase. They will contain the same files. So their content is identical. However, (from "outside") the ...
5
votes
4answers
194 views

Are there any practical attacks on random number generators?

I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section. ...
1
vote
2answers
146 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
0
votes
0answers
40 views

Is a Diffie-Hellman shared secret with a private and public key from the same ECSDA pair considered less secure? [migrated]

If then generate two public / private key pairs using ECDSA - pair A and pair B. Using Diffie-Hellman, a shared secret X is generated using the public key from pair A as the public base and the ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
-1
votes
0answers
18 views

How to perform security testing on application like iCloud Backup and Restore features? [closed]

How to perform security testing on application like iCloud Backup and Restore features? Please share your scenarios and penetration testing tool to break encryption.Also if anyone can suggest the ...
2
votes
1answer
43 views

How to use login details to make a key for AES encryption and decryption

I have recently starting looking into AES encryption for a side project. I am researching this till now so if there is something wrong about my concept please correct it. According to me If i want to ...
0
votes
1answer
53 views

Decrypt AES 128 CTR with the IVs (counter) but not the key

I have the encrypted files, the random IV for each encrypted files and the counter increment function but I miss the key. Is there anyway for me to decrypt the files?
2
votes
1answer
63 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
0
votes
1answer
34 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
0
votes
2answers
72 views

Brute-force attack to exe file [closed]

I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for ...
3
votes
1answer
87 views

Difference in between salt and random padding in cryptography

I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
0
votes
1answer
77 views

Recognise tool by which file was encrypted [duplicate]

I have file with extension *.encrypted. Can you give me some advice how to recognise by witch tool was this file encrypted? It´s not encrypted by some ransomware but by some encrypt tool. When I open ...
2
votes
0answers
113 views

Encrypt with Public Key and decrypt with Private Key using elliptic-curve cryptography [migrated]

everybody. Is it possible to perform public key encryption flow for elliptic-curve cryptography? https://en.wikipedia.org/wiki/Public-key_cryptography I need to implement the following scenario: ...
2
votes
1answer
60 views

How does algorithms ensure public/private keys uniqueness? - RSA

I'm new to security and crpyto, I know that Public/Private keys are generated in a different way depending on the used algorithm, But let's take RSA as an instance (Using prime numbers), Does the ...
25
votes
6answers
8k views

What would be the key size for a picture used as a key?

I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
3
votes
2answers
118 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
2
votes
0answers
68 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
1
vote
0answers
29 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
1
vote
2answers
37 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
0
votes
0answers
23 views

TPM 2.0 Reissue EK Cert

Unlike the TPM 1.2 module, the TPM 2.0 specification allows the platform user to create own EK (Endorsement Key) using EPS (Endorsement Primary Seed) and EKTemplate and obtain a certificate signed by ...
3
votes
3answers
124 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
1answer
32 views

OpenSSL: what's the difference between -kfile and -pass?

It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods: $ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
0
votes
1answer
89 views

Secure Routing without relying on Cryptography? [closed]

Is anyone aware of a routing protocols for Ad Hoc Networks (such as OLSR, AODV, ZRP) which are secure without relying on pre-established key management? What I mean by secure is, preventing data ...
-5
votes
3answers
102 views

Why don't we encrypt punctuation?

I am reading about encryption, and I'm curious why in all of the examples and texts, we do not encrypt the punctuation marks. Plain text: hello world! my name is alice and i'm writing a super secret ...
0
votes
2answers
42 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
4
votes
1answer
79 views

What fundamental problems are solved by using a Key Encrypting Key (KEK)?

I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
5
votes
2answers
1k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
4
votes
0answers
101 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
2
votes
1answer
97 views

When you XOR a random number with non-random number, does that give you a new random number?

XOR has the following truth table: 0, 0 : 0 0, 1 : 1 1, 0 : 1 1, 1 : 0 So per bit in an XOR operation, there is a 50% chance of that result being 1 and 50% chance of it being 0. If you XOR a random ...
0
votes
3answers
98 views

Encryption of TCP communication?

I am using an exe application which is communicating with a Raspberry Pi device with manually configured TCP ports. The application will send data from port 1234 to the Raspberry Pi which is listening ...
1
vote
2answers
49 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
2answers
154 views

AES-256 decryption after key destruction. Possible or not?

Can AES-256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?
0
votes
2answers
39 views

What is the correct terminology for enforcing access control by means of cryptography, or on a privileged list?

I have a server that enforces access control by means of cryptography, by not giving up data, or by a combination thereof. By the former (cryptography), I mean: If a user requests some data, the ...
0
votes
2answers
106 views

/dev/random generate session key

if a server uses /dev/random to generate the random session key with a client. How you can launch a Denial-Of-Service (DOS) attack on such a server?
1
vote
0answers
82 views

How long until quantum computers are able to decrypt RSA using Shor's algorithm? [closed]

Based on this question: How many qubits are needed to factor 2048-bit RSA keys on a quantum computer? It's going to take 20-30 years for quantum computers to reach that state but some people are ...
0
votes
1answer
32 views

Problem identifying this encoding schematic into plain text

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
2
votes
0answers
25 views

ISAAC pseudorandom stream - why is this considered strong crypto?

I was looking for a good pseudorandom stream generator to supplement or replace RC4-drop-lots, in a noncrypto application. Since I'm mixing it with output from /dev/random, I decided not to use ChaCha ...
0
votes
2answers
139 views

Does HTTPS protect against active attackers?

I know that HTTPS protects against passive attackers, due to encryption. Which of course provides confidentiality. So does it protect data(passwords, emails, etc) during traffic, against active ...
1
vote
0answers
159 views

How do I disable TLS Session Tickets in Chrome?

According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
0
votes
2answers
48 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
1
vote
2answers
56 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
8
votes
3answers
2k views

Plausibility of DNA sequence for encryption

To start with: This is in consideration of in-body implants. The answer should (initially) assume there is no record of your DNA sequence mapped by a third party yet. The question boils down to ...