Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

0
votes
0answers
15 views

How to link crypto libraries with COOJA [on hold]

I want to use libsodium library with cooja in order to use the hash function for skymotes. I have tried to link it but every time I get error sodium.h no such file or directory.
-4
votes
0answers
30 views

Strength of a cipher? [on hold]

Which of the following increase the strength of a cipher if any? Shared Secret Key Keep Algorithm Details Secret Use a Key with a Larger Number of Bits
-5
votes
2answers
74 views

Why don't we encrypt punctuation?

I am reading about encryption, and I'm curious why in all of the examples and texts, we do not encrypt the punctuation marks. Plain text: hello world! my name is alice and i'm writing a super secret ...
0
votes
2answers
32 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
2
votes
1answer
47 views

What fundamental problems are solved by using a Key Encrypting Key (KEK)?

I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
5
votes
2answers
1k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
2
votes
0answers
47 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
2
votes
1answer
83 views

When you XOR a random number with non-random number, does that give you a new random number?

XOR has the following truth table: 0, 0 : 0 0, 1 : 1 1, 0 : 1 1, 1 : 0 So per bit in an XOR operation, there is a 50% chance of that result being 1 and 50% chance of it being 0. If you XOR a random ...
0
votes
3answers
85 views

Encryption of TCP communication?

I am using an exe application which is communicating with a Raspberry Pi device with manually configured TCP ports. The application will send data from port 1234 to the Raspberry Pi which is listening ...
1
vote
1answer
37 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
1answer
97 views

AES256 decryption after key destruction. Possible or not?

Can AES256 be decrypted if after the encryption process you destroy the key that must be used to decrypt the data, is it possible?
0
votes
2answers
37 views

What is the correct terminology for enforcing access control by means of cryptography, or on a privileged list?

I have a server that enforces access control by means of cryptography, by not giving up data, or by a combination thereof. By the former (cryptography), I mean: If a user requests some data, the ...
0
votes
2answers
72 views

/dev/random generate session key

if a server uses /dev/random to generate the random session key with a client. How you can launch a Denial-Of-Service (DOS) attack on such a server?
1
vote
0answers
56 views

How long until quantum computers are able to decrypt RSA using Shor's algorithm?

Based on this question: How many qubits are needed to factor 2048-bit RSA keys on a quantum computer? It's going to take 20-30 years for quantum computers to reach that state but some people are ...
0
votes
0answers
25 views

How to prove two ECDSA public keys on two different curves are generated from the same private key [migrated]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
0
votes
1answer
29 views

Problem identifying this encoding schematic into plain text

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
2
votes
0answers
24 views

ISAAC pseudorandom stream - why is this considered strong crypto?

I was looking for a good pseudorandom stream generator to supplement or replace RC4-drop-lots, in a noncrypto application. Since I'm mixing it with output from /dev/random, I decided not to use ChaCha ...
0
votes
2answers
128 views

Does HTTPS protect against active attackers?

I know that HTTPS protects against passive attackers, due to encryption. Which of course provides confidentiality. So does it protect data(passwords, emails, etc) during traffic, against active ...
0
votes
0answers
19 views

How do I disable TLS Session Tickets in Chrome?

According to ssllabs SSL Session tickets are enabled by default. These are the weakest link in TLS, how do I disable them? I'm using the latest stable.
3
votes
0answers
20 views

hmac-sha-512 with a 256-bit key [migrated]

I am implementing hmac-sha-512 in an integrated system. However, one subsystem is only supports the use of 256-bit keys. I read in https://tools.ietf.org/html/rfc4868 that: However, note that [...
0
votes
2answers
45 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
1
vote
2answers
54 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
8
votes
3answers
2k views

Plausibility of DNA sequence for encryption

To start with: This is in consideration of in-body implants. The answer should (initially) assume there is no record of your DNA sequence mapped by a third party yet. The question boils down to ...
0
votes
0answers
43 views

Microsoft Cryptographic Service Providers

I have a few questions about Microsoft's Cryptographic Service Providers. I am creating an AES encryption method whose key is encrypted using the RSA. I am trying to figure out a way to store the RSA ...
1
vote
1answer
27 views

Security Appliance Key Generation

For devices like decrypting HTTPS proxies, there is often a built-in mechanism for generating a key-pair and CSR. An admin can then have their in-house authority sign the CSR with a subordinate CA ...
0
votes
0answers
22 views

Is there any open source SDK for implementing a KMIP server?

Is there any reputable open source SDK for implementing an OASIS Key Management Interoperability Protocol (KMIP) server?
0
votes
1answer
82 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
2
votes
1answer
158 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
0
votes
1answer
66 views

Server-side encryption mechanism (Nextcloud)

I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation. Basically, when you first log in a key pair is created, and the private key ...
0
votes
2answers
97 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
1
vote
0answers
64 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
2
votes
2answers
86 views

Diffie-Hellman protocol CA, confusing

In the Diffie-Hellman protocol, if the participants have their own private key and a generated public key. How can we determine whether or not they have a trusted CA for authentication or just the ...
0
votes
1answer
145 views

understanding MITM attack [duplicate]

hi Everyone please correct me if im wrong for my understanding for the man in the middle attack used in a variant of diffie hellman key exchange . am i right to say that a protocol is susceptible to ...
-1
votes
1answer
64 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
2
votes
1answer
64 views

Sign a lot of messages with same private key [closed]

I'm creating platform where I need to sign a lot of messages (1k/sec), I want to use Ed25519 signature, because it has the best performance. Is it safe to sign that many messages with the same private ...
0
votes
0answers
26 views

How large is AppEngine's Private Key?

AppEngine provides methods for signing binary data - e.g. via the Go language's SignBytes[1] However, it doesn't specify any information about how large the private key is. Is this published ...
1
vote
1answer
54 views

AEAD and nonces explained in layman's terms (Symmetric encryption example using Libsodium)

After almost 4 days of work, I've finally gotten Libsodium crypto_aead_xchacha20poly1305_ietf_encrypt to work and produce the same result in JavaScript and PHP. But I'm confused. The PHPDoc ...
1
vote
1answer
81 views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
2
votes
2answers
51 views

Can be used ECDH with static public key and parameters?

I have protocol required for privacy. Thus, I want to use hybrid cryptography. Base on my knowledge, ECDH is fast and secure. My system consists of 3 main components a trusted-server, client, and ...
71
votes
5answers
14k views

What makes Random Number Generators so fragile?

It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if ...
0
votes
2answers
69 views

Cryptography as an ecosystem

I was thinking about a thought experiment. Let's imagine a world full of crackers such that whenever you encrypt something there will be someone who will try to crack your cryptographic key through ...
0
votes
1answer
86 views

Why use a separate key exchange method like DH during the TLS handshake [duplicate]

Ok first off I'm very familiar with the TLS handshake, the purpose of PKI and key exchange methods. My question is why use a complicated key exchange method like Diffie Hellman when the client could ...
0
votes
1answer
87 views

HSM (Hardware Security Module) [closed]

I am implementing a security solution and I would like some recommendations on existing HSM software. If anyone has done a comparison on the existing HSM software and can recommend good and supported ...
-2
votes
1answer
140 views

How are replay attacks prevented? [closed]

I imagine it’s due to time stamps and sequence numbers. However, those can be replayed as well. The attacker can't create new sequence numbers or time stamps without being detected if the integrity ...
2
votes
2answers
75 views

Why rekey long-lived connections?

Why is rekeying after a certain period of time, or after a certain volume of data transfer, often implemented in modern secure transport protocols such as ESP or TLS? What are the security risks of ...
-6
votes
1answer
182 views

LTE Security: What kind of cryptograpy could be used to fix layer 2? [closed]

New attacks on LTE: https://thehackernews.com/2018/06/4g-lte-network-hacking.html https://www.alter-attack.net/media/breaking_lte_on_layer_two.pdf Layer two (data link) does not guarantee the ...
1
vote
2answers
216 views

Bcrypt data type and length?

I'm using the following library for hashing my password. string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow"); The length is apparently 60 each time. My question is, I'm planning to ...
0
votes
1answer
77 views

How to securely handle a login system [duplicate]

I'm making a desktop application in C# and I want to know If I'm handling this (from security perspective) as should be or not. My Users table have both hashed_password and salt, both are binary(32). ...
1
vote
1answer
62 views

What function is used to generate client random in TLS

I've been learning TLS. During the Client-Server Hello their random values are shared. The client generates a 28 byte random and combine it with 4 bytes of epoch time to generate a 32 byte random ...