Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

0
votes
1answer
18 views

Regarding Union Bounds and Probability of Events [on hold]

This is somewhat of a math question as well but part of a Cryptography course I'm working through online. The course covers vulnerabilities when dealing with non-uniform distributions among events ...
0
votes
1answer
42 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
1
vote
2answers
69 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
0
votes
0answers
56 views

What does w.r.t. mean [closed]

What does the abbreviation w.r.t. mean in the context of security and/or cryptology? It's being used the crypto books combined with other terms like: anonymity w.r.t. third parties constant-round ...
3
votes
1answer
80 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
0
votes
2answers
37 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
0
votes
0answers
31 views

Cheap(er) HSM FIPS 140-2 [closed]

I'm currently building a project including electronic signature that requires the eIDAS certification. Currently, the eIDAS certification requires an HSM with the FIPS 140-2 Level 3 norm. But these ...
2
votes
1answer
81 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
0
votes
0answers
45 views

Fix use of hardCoded Cryptographic key

I have a method that obtains the secret key to be able to encrypt with AES.The secret key is stored in database. As seen in the method, I use a Stored procedure to get the secret key value and assign ...
-5
votes
1answer
66 views

Can someone tell me what is this encryption method? [duplicate]

DQUC//S+y9uZxanuAS0WTQBlAG4AZQBkAHwBZQByACAAegBhAGQAYQBEASAAVwBpAG4AZABvAHcAcwAC3/...
1
vote
1answer
73 views

Deniable proof of authorship

The title may read like a contradiction, but I would like to know whether a cryptographic solution exists to the following problem: Problem statement Suppose Alice wants to write a document using a ...
2
votes
0answers
33 views

How do GnuPG smartcard generate reliable random data?

I'm generating a private key on my new GPG smartcard at this very moment. On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc. How does ...
2
votes
1answer
92 views

If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]

PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"
0
votes
0answers
34 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
3
votes
1answer
98 views

Is it possible to fake ECDSA signatures?

Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs. https://www.reddit.com/r/btc/comments/9xpivk/...
4
votes
2answers
390 views

A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean?

Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence ...
3
votes
1answer
71 views

How much less secure is a password with a repetitive pattern of characters?

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient. So my idea is to just use a short password and repeat it a few times like this: ...
0
votes
0answers
44 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
2
votes
2answers
51 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
0
votes
1answer
70 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
4
votes
4answers
298 views

Can I use a user's password hash as the AES key to make a one time token?

I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
2
votes
1answer
62 views

Which high speed / high security ECC curves are preferred on mobile devices?

I'm looking for the most common denominator of ECC curves in consumer devices. This article describes how a particular ECC curve is ideal for Intel based motherboards. Since I'll be targeting mobile ...
0
votes
2answers
94 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
1
vote
1answer
102 views

Authenticate that I am the poster of a certain anonymous message

I'm a programmer, and I've made a nifty script that scours a certain internal forum site. Messages posted on the forum are all anonymous, so I'm wondering how exactly I can get my script to realize ...
1
vote
0answers
40 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
8
votes
4answers
154 views

How much security expertise does a general application programmer need to develop software ethically? [closed]

I am curious about this. I saw this thread: Why shouldn't we roll our own? and this answer: https://security.stackexchange.com/a/18198/144241 which had on it this comment, which had the second ...
2
votes
5answers
130 views

Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?

Situation as follows: Let's assume two (or more) containers, encrypted using the same passphrase. They will contain the same files. So their content is identical. However, (from "outside") the ...
6
votes
4answers
230 views

Are there any practical attacks on random number generators?

I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section. ...
1
vote
2answers
210 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
2
votes
1answer
51 views

How to use login details to make a key for AES encryption and decryption

I have recently starting looking into AES encryption for a side project. I am researching this till now so if there is something wrong about my concept please correct it. According to me If i want to ...
0
votes
1answer
65 views

Decrypt AES 128 CTR with the IVs (counter) but not the key

I have the encrypted files, the random IV for each encrypted files and the counter increment function but I miss the key. Is there anyway for me to decrypt the files?
2
votes
1answer
65 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
0
votes
1answer
40 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
0
votes
2answers
87 views

Brute-force attack to exe file [closed]

I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for ...
3
votes
1answer
111 views

Difference in between salt and random padding in cryptography

I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
0
votes
1answer
77 views

Recognise tool by which file was encrypted [duplicate]

I have file with extension *.encrypted. Can you give me some advice how to recognise by witch tool was this file encrypted? It´s not encrypted by some ransomware but by some encrypt tool. When I open ...
2
votes
1answer
72 views

How does algorithms ensure public/private keys uniqueness? - RSA

I'm new to security and crpyto, I know that Public/Private keys are generated in a different way depending on the used algorithm, But let's take RSA as an instance (Using prime numbers), Does the ...
25
votes
6answers
8k views

What would be the key size for a picture used as a key?

I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
3
votes
2answers
121 views

How are ciphers related to cryptographic algorithms like DES or AES?

It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael). ...
2
votes
0answers
120 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
1
vote
0answers
32 views

Automatic fetch Luks keyfile over ssh and decrypt partition [closed]

I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about ...
1
vote
2answers
49 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
3
votes
3answers
129 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
1answer
101 views

OpenSSL: what's the difference between -kfile and -pass?

It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods: $ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
0
votes
1answer
89 views

Secure Routing without relying on Cryptography? [closed]

Is anyone aware of a routing protocols for Ad Hoc Networks (such as OLSR, AODV, ZRP) which are secure without relying on pre-established key management? What I mean by secure is, preventing data ...
-5
votes
3answers
133 views

Why don't we encrypt punctuation?

I am reading about encryption, and I'm curious why in all of the examples and texts, we do not encrypt the punctuation marks. Plain text: hello world! my name is alice and i'm writing a super secret ...
1
vote
2answers
47 views

How to overcome slow process of creating and verifying digital signature?

From what I understood is the digital signature is a long process and have following steps: Hashing the Message Plain Text using a well-known (public) hashing algorithm. Encrypting it with sender's (...
4
votes
1answer
86 views

What fundamental problems are solved by using a Key Encrypting Key (KEK)?

I've read several questions regarding KEKs but have not quite found one that comprehensively addresses why we would choose to use a KEK. This excellent answer by Mike Ounsworth explains how KEKs allow ...
5
votes
2answers
2k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...