Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Can't find private key file given CspKeyContainerInfo

I'm trying to use PowerShell to extra a private key from a certificate stored in the personal store. Most of the tools seem related to Local Machine certificates and are not working, and I hit on the ...
user avatar
  • 101
-1 votes
0 answers
18 views

I am looking for how you can Identify what type of cipher this encoded message is in? [duplicate]

PCtvaGM3cUhSTEVhYGMsO2U5SFpBVFZAJEdwJSQ7K0VWOi4rQEJnVkRJbW0jK0BDJ2FEMDlgMUYqJk8kQDwtSTgrREdtPkRmcChDRioyR0JBU2whJEVjbDIwRVplZS5BMD8pLStFcU85Q2BtZUBAPGl1LURmVEU0QVRBbzBEZz5jLSs+...
user avatar
0 votes
1 answer
33 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
user avatar
0 votes
0 answers
31 views

How do different types of cyphers relate together? [migrated]

I understand that there are symmetric and asymmetric (public-key) cyphers. The first have the same key used for encryption and decryption, while the second use a public key for encryption and a ...
user avatar
  • 403
1 vote
0 answers
89 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
user avatar
  • 99
1 vote
1 answer
42 views

Is providing a static TLS key during an OpenVPN handshake useless for commercial providers?

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a ...
user avatar
  • 99
0 votes
0 answers
9 views

ElGamal same private and random key attack [migrated]

I'm having difficulty understanding this. Consider two messages are encrypted using the same cyclic group order q, generator g, private key x, and random parameter y. The attacker knows a plaintext m1 ...
user avatar
3 votes
2 answers
106 views

Does any real world protocol makes use of the associated data in AEAD?

I'm trying to find evidence of use of the associated data (authenticated cleartext associated with the encrypted and authenticated data) feature offered by AEAD (Authenticated Encryption with ...
user avatar
  • 4,307
-2 votes
1 answer
100 views

Steganographically hide encrypted packets for VPN, Tor, etc?

We all know about different encryption methods used today in secured connections like VPN, Tor, etc. However, there is an issue with usage of those. Even if the outsider can not decrypt the message, ...
user avatar
0 votes
0 answers
13 views

Import BDK encrypted under the Transport Key KEK on HSM

I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK. Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
user avatar
0 votes
1 answer
43 views

Is api encryption key vault services really secure?

I am looking for a secure (and as easy as possible) way to store my encryption key. I have been looking at some services that will hold the key for you and then you can retrieve it with an api. The ...
user avatar
7 votes
6 answers
5k views

What's the point of hashing a password and then sending it to the server?

If the password is hashed and then sent to the server where the hash is compared to the stored hash, this basically means that if someone had that hash they can still log in by sending the hash in the ...
user avatar
1 vote
1 answer
77 views

End To End Encryption Model

I have an architecture which requires a certain subset of data to be more heavily secured and encrypted. The main parameters which I believe meet the scope of the project are as follows: Data should ...
user avatar
1 vote
3 answers
157 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
user avatar
2 votes
1 answer
271 views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
user avatar
2 votes
0 answers
31 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
user avatar
  • 111
4 votes
2 answers
2k views

Acceptably resolving a serious vulnerability disclosure

Hypothetical scenario: An organisation with a large user base who rely on the service's end to end cryptography has a comprehensive vulnerability disclosure made to it privately from a research ...
user avatar
  • 41
-2 votes
2 answers
57 views

Vulnerabilities due to improper use of cipher's mode of operation? [closed]

I want to know if there was any vulnerability discovered - whether known to be exploited or not - in cryptographic systems due to improper use of the underlying block-based encryption algorithm's mode ...
user avatar
  • 1
0 votes
1 answer
93 views

Legacy OpenSSL Ciphers

I can see that with openssl list-cipher-algorithms I can get a long list of ciphers that can be used to encrypt data. However, I know that not all methods are equally secure and some may even be ...
user avatar
  • 3
2 votes
3 answers
147 views

Why is it important to rotate symmetric keys?

I've read and heard from multiple sources over the years that rotating symmetric keys used to encrypt and decrypt large amounts of data over time (for example all of the network traffic from some ...
user avatar
  • 123
1 vote
1 answer
40 views

How are session keys transferred between a client and a server?

Session keys are generated during TLS handshake and are transferred from clients to server through asymmetric encryption FOR ONCE. However, I have heard that session keys are single-use, which mean a ...
user avatar
1 vote
0 answers
32 views

Terminology for exchanging one piece of signed information for another

Applications that use cryptographically signed information for multiple purposes have the risk that one piece of signed information can be exchanged with another. When you use JWTs as session tokens, ...
user avatar
  • 28.6k
1 vote
0 answers
44 views

Diffie Hellman with server public key embedded on the client

First, I realize trying to come up with your own crypto schemes is not a good idea. I'm a relatively new member of a team of developers utilizing such a custom scheme and I'm trying to come up with ...
user avatar
  • 1,027
0 votes
1 answer
20 views

Where can I find the definitions for Cipher/Kex/etc groups in Linux's crypto-policies?

I just ran a security scan on a new server, and one of the lower-priority recommendations was to disable all key exchange algorithms that use SHA-1 (for example, diffie-hellman-group-exchange-sha1). I ...
user avatar
  • 101
0 votes
1 answer
44 views

How do different secret-key algorithms generate the same data?

How do different secret-key algorithms generate the same data? In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the ...
user avatar
  • 3
1 vote
1 answer
81 views

Is this encryption method symmetric or asymmetric? When to use symmetric encryption over asymmetric encryption?

I'm new to the whole cryptography thing and I want to implement it in my app to store non-personal user data. I've been trying to get my head around the whole thing by reading articles and questions ...
user avatar
1 vote
1 answer
42 views

Asymmetric encryption between a monitoring unit and a tablet device

My task is to find asymmetric cryptography that a private key will be associated with a monitoring unit. The monitoring unit will connect to a tablet device which will show a live feed from the ...
user avatar
  • 13
0 votes
0 answers
25 views

The difference between a virtual door-lock and a public key [duplicate]

The thing that helped me to understand what is a "public key" was to parallel it with a door lock: The door lock is public in the sense that anyone can try to unlock it and the door key is ...
user avatar
3 votes
1 answer
502 views

What signature and certificate signing is all about

I know that X.509 certificate signing process includes creating a CSR (certificate signing request) and then the following happens: Some data's from the certificate to be signed hash is computed ...
user avatar
  • 143
0 votes
1 answer
83 views

Find pre-images of hashed email addresses

This is a cryptographic challenge I was given: I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com"). According to hashes.com: Possible ...
user avatar
0 votes
0 answers
21 views

Can a AES 256 key be recovered with the encrypted and decrypted message? [duplicate]

I have no advanced knowledge in cryptography. Is it possible to recover the AES-256 key with the decrypted and encrypted message?
user avatar
  • 101
0 votes
0 answers
117 views

How secure is the Android Keychain

I have been able to understand the Android KeyChain API via this link. However, I want to ask how secure this API is, on the Android OS, the KeyStore is available on a cryptographic scale, but I would ...
user avatar
0 votes
0 answers
15 views

need help decoding [duplicate]

i am trying to decode this data but have no idea where to start. any help would be greatly appreciated 4,2,93eba2404abd4eaca468c828178cf3af,B005,167c5351,16852f43,27c,0,l6VERmVDGmY/YdIbPo5lUODp418= 4,...
user avatar
  • 1
0 votes
1 answer
67 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
user avatar
  • 1
0 votes
1 answer
69 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
user avatar
13 votes
5 answers
3k views

Pseudorandom vs. True Random

Proper security algorithms demand true random numbers. For instance, secret keys & initialization vectors should never not be true random. However, generating numbers using Java's Random library ...
user avatar
-1 votes
2 answers
101 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
user avatar
8 votes
3 answers
1k views

What makes a symmetric encryption algorithm cryptographically secure?

I'm trying to learn a bit more about symmetric encryption and found out that basically every symmetric encryption and decryption is (somehow) in the end based on a simple XOR-Byte-Toggle with using a ...
user avatar
0 votes
1 answer
74 views

Ownership proof scheme

I'm developing a device that will require ownership proof to activate HOTP authorizations. The HOTP codes will be used in the BLE bonding between the device and the owner's phone. I came up with the ...
user avatar
  • 3
2 votes
4 answers
382 views

SSH Server Configuration Best Practices?

I have been tasked with reviewing the settings of an SSH server, I'm currently trying to figure out what are the best practices, and I'm having a bit of trouble finding a good answer. I keep finding a ...
user avatar
  • 23
5 votes
1 answer
196 views

Design of a web based password vault

I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
user avatar
3 votes
3 answers
2k views

Password based RSA encryption

I recently learned (read) the math behind RSA encryption (algorithm). Now, I wonder if there is a way to use a custom password instead of the private key. Imagine a web application, where user signs ...
user avatar
0 votes
1 answer
122 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
user avatar
  • 162
0 votes
0 answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
user avatar
  • 11
1 vote
2 answers
255 views

Possible attacks using public key in a certificate

this is purely an exploratory question. If this is not the right place to ask for it, please point me to the right one. TLS version: TLS 1.2 CIPHER SUITE : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (any ...
user avatar
4 votes
1 answer
99 views

Is it possible to use HKDF in the TPM?

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
user avatar
  • 43
2 votes
2 answers
173 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
user avatar
0 votes
1 answer
238 views

Is DSA-1024 safe to sign package repositories ? What are the reasons?

I recently found that the latest release of a major Linux distribution (MX Linux) uses DSA-1024 in /etc/apt/trusted.gpg and in /etc/apt/trusted.gpg.d/*.gpg It also probably uses SHA-1 as the signature ...
user avatar
0 votes
0 answers
93 views

How secure is Identity-Based Encryption and certificateless cryptography?

The above two standards encryption schemes are used to encrypt the messages in different applications. In both cases, a trusted third party is used to create a whole encryption environment, which is a ...
user avatar
0 votes
1 answer
128 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
user avatar

1
2 3 4 5
46