Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
-1 votes
0 answers
69 views

Can world coin be hacked? [closed]

There's a new startup by Sam Almatan, they give away cryptocurrency, through their app, for iris scan. If it's a real cryptocurrency, where do they get enough to give it away every month? As I know ...
Den4ik's user avatar
  • 19
0 votes
1 answer
65 views

relation passphrase and password-based key derivation

I am not totally sure how the following concepts are related, could someone please explain? password-based key derivation passphrase that can be passed to crypto.generateKeyPairSync (in Node.js) ...
yolooow's user avatar
  • 15
1 vote
0 answers
57 views

Group admin in end-to-end encrypted group chat

I was thinking about building a simple end-to-end encrypted chat with group chat capabilities. Please keep in mind that 1) it's just an experiment to help me learn more about cryptography and 2) I'm ...
Tryer outer's user avatar
1 vote
1 answer
69 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
Nifil's user avatar
  • 113
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0xENDER's user avatar
0 votes
0 answers
38 views

EEPROM with HDD calibration data

I understand that in a Hard Disk Drive (HDD) there is EEPROM which stores calibration data. This is not directly accessible by any ring-3 (usermode) or ring-0 (kernel mode) programs. I was curious as ...
user5623335's user avatar
0 votes
1 answer
50 views

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
0 answers
39 views

How to securely store signature file

I am using TPM to to encrypt and sign my data. But since I am not security expert, I need to come to you guys :D I am developing this app to verify file content. I already has this part sorted out ...
Croksie's user avatar
0 votes
0 answers
23 views

Cryptography system: same fingerprint => same private key [duplicate]

Would it be possible to design and attach a system to a smartphone whereby a public key cryptography system is attached a unique private key to a fingerprint without storing anything (the same ...
Joselin Jocklingson's user avatar
0 votes
1 answer
112 views

Algorithms when using client side hashing plus server side hashing

So if I got this right from my intense research, the following procedure would be preferrable: Use the PBKDF2 key derivation function to derive a secret key from the users password on the client side. ...
shaniag's user avatar
2 votes
1 answer
148 views

Securely storing derived key in web app and handling user identity

I am currently working on an open source project to securely store notes, payment card numbers, etc. I would like to implement a zero knowledge encryption method so that no one but the user can ...
mson's user avatar
  • 21
3 votes
1 answer
2k views

How does the SSL/TLS protocol determine if a certificate is expired or not?

I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
Noob_Guy's user avatar
  • 139
0 votes
0 answers
86 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,473
0 votes
0 answers
84 views

Is it possible to securely use a remote service in a completely hostile network environment

A worldbuilding technical question! I am an extremely evil power-mongering country government. There is a company S under my jurisdiction, physically located completely inside the borders. This ...
hijarian's user avatar
  • 109
2 votes
1 answer
107 views

cryptography - BitBox02 firmware signed & public key attached to firmware image for verification

Bootloader of the BitBox02 crypto wallet verifies the main application with the public keys that are attached to the firmware update itself. Next to that, there are signatures of the public keys, ...
unalignedmemoryaccess's user avatar
1 vote
1 answer
227 views

How to get a 12 bytes authentication tag in AES-GCM

i want to generate a 12 bytes authentication in AES-GCM. my code only give me an output tag of 16 bytes. i have tried to use the min_tag_length but it rises an error. can i get your guidance, thank in ...
Zeus8497st's user avatar
1 vote
2 answers
203 views

Encrypting/wrapping a private RSA key in PKCS8 using AES-GCM and openSSL 3.20 (library not command line tool)

I need to protect a private RSA key using a passphrase but using AES-GCM for the actual encryption. This is normally done using various a combination of openSSL library calls. However, I now need to ...
Claude's user avatar
  • 11
0 votes
1 answer
110 views

Does self-signed encryption certificate violate "no multi-use keys" principle?

Say that I have generated an RSA keypair, which I intend to publish only for use with RSA-KEM; I can see that this is provisioned for: The intended application for the key MAY be indicated in the key ...
JamesTheAwesomeDude's user avatar
0 votes
0 answers
105 views

RSA vs Shor's Algorithm/Fast Factoring — Server Credentials & MITM

I've watched a lot of videos on Shor's Algorithm and Quantum Computers. Most of these videos say these two things undermine RSA via fast-factoring, but they never really explain how fast-factoring is ...
Sam Z's user avatar
  • 1
1 vote
4 answers
180 views

Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User

Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
Moritz_st's user avatar
0 votes
1 answer
224 views

Why in "openssl pkeyutl -verify" is needed both public and private keys? Why isn't public key enough?

I created a signature with: openssl pkeyutl -sign -inkey rsa.key.bob -in plain -out plain.sig.bob and to verify, Alice just needs to use Bob public key to check the authenticity of the message. So ...
Allexj's user avatar
  • 137
0 votes
0 answers
75 views

Remote eIDAS Qualified Signatures: Control of Signature Activation Data

In eIDAS Remote Qualified Signatures, but also in other Remote-Signature Solutions, the cryptographic keys are held by the Remote Signature Provider. The user uses some method, e.g., a smartphone app, ...
ARGYROU MINAS's user avatar
1 vote
1 answer
169 views

How to break poorly implemented One-Time-Pad

I have a cipher text, that was created using One-Time-Pad, but the idea is that it was encrypted badly. The message, a section of a book, was encrypted using a pad 256B long repeated many times over (...
Magpie's user avatar
  • 11
2 votes
1 answer
106 views

DHE key exchange with p value 257 bytes but a pubkey of 256 bytes

I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below: Diffie-Hellman Server Params p Length: 257 p: ...
ayivaak's user avatar
  • 23
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
Slybot's user avatar
  • 101
0 votes
0 answers
75 views

Security implication of loading untrusted private keys

The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) ...
DannyNiu's user avatar
  • 374
2 votes
2 answers
535 views

LUKS: How many iterations are enough?

The luksFormat command accepts iteration time as a parameter, not iterations. That obviously leads to quite different number of iterations depending on the hardware doing the encryption. However if ...
graywolf's user avatar
  • 425
0 votes
0 answers
182 views

Bypassing AES encryption if the keys are not in local,but in server

When I conduct a mobile pentest, I have run into payload encryption in HTTP traffic. In general, the AES key and IV ( initialization vector) are located in APK, and can be used to encrypt the payload ...
Not a Salmon Fish's user avatar
0 votes
1 answer
299 views

Why are there so many different encryption algorithms?

Taking a quick look at Wikipedia, there happens to be a vast amount of different encryptions/cryptographic algorithms. Yet, many of the listings show that these encryption methods are not in use today ...
Bill Joe's user avatar
0 votes
1 answer
240 views

How to secure hundreds of AES keys

I need to store a large amount of AES keys and provide an API to decrypt user-provided ciphertext. The application flow is as follows: The user authenticates The user makes a POST request with some ...
Riccardo Salve's user avatar
1 vote
1 answer
116 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
1 vote
1 answer
184 views

Which algorithm does CryptGenRandom use on my laptop?

I have an Ideapad Gaming laptop by Lenovo, with an Intel(R) Core(TM) i5-10300H processor. On this laptop I have Windows 10 installed. To generate random numbers, I use the CryptGenRandom function. ...
Riemann's user avatar
  • 113
0 votes
1 answer
110 views

Passing user identity to a different REST service

I have two use-cases I am trying to solve. A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
Sunil Dabburi's user avatar
0 votes
1 answer
178 views

Is backing up the seed used to generate an RSA key pair a secure practice?

Assume I wanted to generate an RSA key pair, and create a backup of it. It is possible to back up the randomness source used to generate the keypair instead of the keypair itself and still recover the ...
Jakub's user avatar
  • 135
0 votes
1 answer
569 views

How to decrypt ECDSA_secp256k1 private key from PEM format generated with OpenSSL

I'm trying to decrypt an encrypted ECDSA_secp256k1 private key generated using the OpenSSL CLI command openssl ecparam -genkey -name secp256k1 | openssl ec -aes-128-cbc -out ecdsa_priv.pem but I want ...
petreze's user avatar
0 votes
1 answer
173 views

SymmetricKey vs SecRandomCopyBytes

Can SymmetricKey be used as substitute for SecRandomCopyBytes? I found this code snippet in WWDC19 video var key = Array(repeating: 0, count: 32) let err = SecRandomCopyBytes(kSecRandomDefault, ...
Артур Мурадянц's user avatar
0 votes
2 answers
386 views

Why AES256 with SHA384 in TLS [closed]

Is there any concrete/solid rationale for this choice of cipher? Seems to be the default when I connect via TLS1.2 to an Apache2 server (whatever latest version on Debian 11) with configuration lines ...
Cal-linux's user avatar
  • 113
3 votes
1 answer
999 views

What is the point of the “AES Key Wrap” algorithm?

What is the point of the “AES Key Wrap” algorithm prescribed for use with CMS-like contexts in IETF RFC 3394? Just look at the algorithm (tacked on to the end of this post), informally, it smells a ...
JamesTheAwesomeDude's user avatar
0 votes
2 answers
186 views

Is there any good way of calculating a brain-generated password's entropy?

After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.). Let's ...
Dan's user avatar
  • 165
1 vote
0 answers
123 views

What are the ranges of values for DH parameter a and DH parameter b [closed]

I have discovered that Diffie Hellman(DH)shared key is unequal in Apple Numbers, Google Sheets, and Mac Excel (2008). In Section 1.0, the first try at a solution uses a small Prime to produce certain ...
Simple.Simon's user avatar
1 vote
2 answers
172 views

What's the shortest message you need to claim ownership of another message?

Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following. The hash/ characteristic string is compact enough (ideally a few ...
Boson Bear's user avatar
1 vote
0 answers
106 views

Does openssl3.1 support UEFI target with FIPS enabled?

I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
sr01853's user avatar
  • 111
15 votes
6 answers
8k views

Is it possible to generate a file with a given sha256sum checksum?

Is it possible to generate a file with a given sha256sum checksum? That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
Amruth A's user avatar
  • 223
0 votes
1 answer
146 views

Are there any downsides to publically available encrypted data?

I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key,...
willuhmjs's user avatar
0 votes
2 answers
252 views

Is using weak random numbers for the initialization vector of AES just a theoretical issue?

I'm the maintainer of pypdf, a Python library for reading/manipulating PDF documents. I recently discovered that pypdf used random instead of secrets for ... Generating the initialization vector (IV) ...
Martin Thoma's user avatar
  • 3,932
1 vote
1 answer
176 views

Java Cryptography classes - program agnostic usage

We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
StephenG's user avatar
0 votes
0 answers
65 views

How to find the correspond hash algorithm? [duplicate]

I'm currently working on a project. but i still facing some issue due to some crypted data. i know the plaintext and got the correspond hash. plaintext: C018AE45B37DAE665486F4151E0C1E6F Hash: rROkd+...
Zeus8497st's user avatar
1 vote
1 answer
168 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
Dolda2000's user avatar
  • 201
1 vote
0 answers
35 views

Decrypting a Base64 ciphertext [duplicate]

I am working on a challenge that includes decrypting a piece of ciphertext. The sample decryption provided is as follows: ...
Karim Elezabawy's user avatar
1 vote
1 answer
123 views

Encrypted semantic search

I want to implement semantic search but in an encrypted fashion. For storing passwords, we store Enc(password) in a database, and when a user logs in, we check if Enc(query) == entry in the database. ...
mathenthusiast8203's user avatar

1
2 3 4 5
48