Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Measuring entropy of a uniform distribution source [migrated]

I have a problem to understand what entropy is at all. When I was reading about uniform distribution, one article stated: When there is an equal chance for all items to appear, we have a uniform ...
0
votes
0answers
19 views

Nth term for Linear Congruence Generators [migrated]

We can get the N+1th term for a Linear Congruence Generator like this: x[n+1] = A * x[n] (mod m) by raising the A to the exponent of n like this: x[n+1] = A**n * x[0] (mod m) Assume A=48271 and m=2**...
0
votes
0answers
7 views

Is there any chance of failure in Cryptography [migrated]

With my limited knowledge of cryptography and its correct terms, functions (md5, base64, sha, aes or whatever) turn an input into encrypted output. For example, if the following input turns into ...
2
votes
0answers
44 views

What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results. As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
29 views

design and implement a hybrid crypto system that involves 3DES and RSA [closed]

RSA must be used at the beginning to securely exchange the session keys of 3DES between Alice and Bob. 3DES must be used for encryption/decryption of the exchanged data. OFB should be used as a mode ...
2
votes
1answer
74 views

Why AES output has more size than my plaintext?

I have enciphered a vector of bytes that has 17 bytes in itself. However, When I try to enciphered with AES, AES output has a 32-byte size? What is happening here?
0
votes
0answers
33 views

Curve25519 vs. Curve25519 and AES Key vs. Curve25519 AES Ciphertext (Instagram)

I am trying to send a password from a client to the server. I just don't know how to encrypt it. method: I used a website (Instagram) as a guide here. Here the password is encrypted with AES and the ...
6
votes
0answers
956 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide? [migrated]

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
0
votes
0answers
39 views

Are libhydrogen's Gimli permutations production ready?

I've recently had a situation in which a recommendation for an easy-to-use, hard-to-misuse cryptographic library for Java was required. The first choice was Google's Tink, since it was designed ...
1
vote
0answers
65 views

Why is a password encrypted with AES and then sent back to the server together with the key with RSA (Instagram)?

I am trying to understand an encryption process on a website (Instagram). As far as I know, a public key is sent from the server to the client. Then the password is encrypted with AES_GCM_256 and ...
0
votes
1answer
101 views

Did The Wire invent the “Jump 5” cipher?

N.B. Asking this here instead of Movies.SE because I'm wanting to know about the cipher itself and any history, which this site is more suitable for. In S01E05 of The Wire, at around 45:00, it's ...
0
votes
0answers
18 views

How to connect Windows CNG with Nginx in order to protect server private keys?

As I read on this question, private keys are protected by CNG mechanisms in Windows. So using NGINX, I would like to know how to establish the communication between NGINX and this cryptographic API in ...
1
vote
0answers
19 views

Encrypt an sqlite3 database using python [migrated]

I am trying to create a password manager, I have successfully been able to create the encryption key by using a key derivation function on the master-password using PBKDF2 and SHA256. The passwords ...
-2
votes
1answer
78 views

Keyless entry system

To what extent can cryptography help protect against relay attacks (on vehicles)?
7
votes
0answers
710 views

Is double sha256 the best choice for Bitcoin? [migrated]

So I was just curious. I really look up to Blockchain technology and I have read that Bitcoin uses double sha256 for hashing. ( from what I understood, double sha256 is essentially sha256(sha256(value)...
1
vote
2answers
54 views

Why our key and our plaintext should have a same size in One Time Pad

I was reading Serious Cryptography book. I am a newbie in cryptography field who try to learn as possible as he can. In this book, there is the following section of phrases: For example, if a ...
0
votes
1answer
64 views

Calculate AES-GMAC

I have a symmetric key and I have the data that needs to be authenticated. So one of the solution that I have in mind is to use the AES GMAC. I know there are other MAC's such as HMAC or hash ...
-1
votes
0answers
17 views

How To Generate An OV - Extended validation certificate using OpenSSL [duplicate]

I Want To Generate A Ov Cert With The Authority PmzDevENV But I Cant Find Out How (I Want To Use OpenSSL) I Want To Do This So That PADLOCK PmzDevENV [US] Will Appear In The Browser
1
vote
2answers
76 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
79 views

E2E Encrypting User Data [closed]

I'm building an end-to-end encrypted web-app. I plan to use ECDH + P256 curve for generating private/public keys. The private keys are saved onto the user's computer and the public keys are stored on ...
1
vote
1answer
62 views

Is Python's `secrets` module using the same code as the `random` module?

The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
2
votes
1answer
79 views

How to make sure the GPG's home directory is safe?

I am a novice with cryptography. I am studying the GPG for encryption of my backup files. My current understanding is that the keys are saved in the home directory of GPG. And it means that if someone ...
1
vote
1answer
42 views

How to create same ssh key pair on different systesm at different times

Was going through the SSH key pair generation and did tried with the few systems i have. refer to the below command and the thumbprint value post key pair generation. $ ssh-keygen.exe -t rsa ...
1
vote
1answer
109 views

Python generated RSA keys looks the same

I'm working on a sharing protocol, and the handshake, authentication etc. is done with RSA keys. By default I use 4096 bit keys, but it seems the beginning and end of any key generated are the same, ...
0
votes
0answers
21 views

Are there any formal tests to estimate encryption strength? [migrated]

So I'm trying to design/make my own encryption algorithm and I believe it to be ok. I'm not saying it's extra secure but I know it's not useless so, what I was wondering is if there are any specific ...
1
vote
1answer
37 views

How am I supposed to use a revocation certificate, and can there be multiple revocation certificates for the same private key?

I just generated a revocation certificate for my key. Unfortunately I don't fully understand the concept. Here are my questions: How exactly am I supposed to use it? Suppose for example that my ...
1
vote
1answer
86 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
0
votes
0answers
22 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
0answers
28 views

Remote digital signature (eidas)

Except the usual implementations of a digital signature there is the "remote" digital signature implementation (is a standard created by eidas). There are some companies that provides remote ...
1
vote
0answers
27 views

Can I read environment process variables of a react client in a browser?

I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
2
votes
1answer
73 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
3
votes
1answer
81 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
1answer
53 views

How to generate ffdhe from rfc7919

Everyone recommends to use the pre-defined ffdhe groups from https://tools.ietf.org/html/rfc7919 There are multiple sources (for example mozilla) where I can download the DH PARAMETERS file but how ...
0
votes
0answers
33 views

Cryptocurrency recovery passphrases in the cloud?

Currently, my recovery passphrases are just handwritten on a bit of paper. I know myself and don't feel very confident that I'll still know where that paper is when I need it in however many years. So ...
2
votes
0answers
66 views

Compiler-induced information leaks/side-channels in cryptography implementations

In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits. ...
0
votes
0answers
53 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
1answer
84 views

Help identify a simple, reversible cipher/encryption algorithm [duplicate]

I'm trying to help a small business transition out of an obsolete, obscure piece of software, and app support is, unfortunately, non-existent. To fully export the data for the new system, I need to be ...
2
votes
2answers
82 views

With AES, does key format make a difference to security?

For context, I'm assuming the attacker knows the format of the key. Do these two keys have the same strength, or by leaving the hyphens in the key am I reducing the security by a partly-known-key ...
1
vote
1answer
77 views

Public key encryption with modified private key requried

I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate ...
-1
votes
1answer
115 views

How does Zero Knowledge Proof prevent lying?

I have seen and read several videos and articles that try to explain how Zero Knowledge Proof systems work. In these examples, there is a verifier of information, and a prover of information. The ...
0
votes
1answer
71 views

Symmetric encryption - given plain text, produce cipher text without key

Suppose Alice and Bob are communicating using a peer-reviewed symmetric encryption algorithm such as AES-256. Bob possesses a private encryption key to decode messages from Alice, but Alice does not ...
1
vote
5answers
192 views

Attacks Relying on Poor Entropy

I'm creating a quantum random number generator as part of my thesis. As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
2
votes
1answer
121 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
0answers
75 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
1
vote
1answer
78 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
0answers
48 views

Are these tests enough to check if a web app is vulnerable to Padding Oracle? How to test further?

SCENARIO: a web application using with ASP.NET. In the home page source code there are links like: ./WebResource.axd?d=[string with 87 characters] ./ScriptResource.axd?d=[string with 172 characters] ...
0
votes
1answer
33 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
1
vote
1answer
133 views

How to decrypt a ciphertext encrypted in AES CTR mode if you are given ciphertext, plaintext, and key?

Question is the title. To give a bit more information, the same key is used for all ciphertexts and I know ciphertexts C1 and C2 and plaintext P1, which corresponds with C1. The incrementing method ...
0
votes
1answer
59 views

Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information

Regarding the insecure transmission of data over a network. When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...

1
2 3 4 5
45