Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

2
votes
1answer
61 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
3
votes
2answers
692 views

Diffie-Hellman with non-prime modulus

When using the Diffie-Hellman key-exchange, it is said to be important to use a safe prime. However, if a non-prime modulus with sufficient bit-length is generated, is there an attack that can be used ...
0
votes
1answer
75 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
-3
votes
0answers
45 views

Sending an encrypted message to another user using secret-key cryptography [closed]

A primary weakness of secret-key algorithms is keeping the single key secure. In order to send an encrypted message to another user using secret-key cryptography, the other user must possess the same ...
-1
votes
0answers
26 views

i want to decrypt the msg but dont have key [duplicate]

"FGFNJ TYNYI FBMXM TQBJF JSQMI KLTDJ NYTYP WXJTW SJPWS EKOGB WAHUR BOAFG HBMOH VOUPI SUDPT HSGST FRCRS IHIAR BCHSA YUCOS WSTIF RDVZR SKRNC PKXJL FKYFG KENKG JVJFY RVNGF IVTVC RVVDV KBJNB JUVTF HIKPY ...
0
votes
1answer
48 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
1
vote
0answers
81 views

How to crack encrypted Android SQLite DB?

I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts, How do we ensure that DB is encrypted properly and it is ...
3
votes
2answers
142 views

Feasibility of cracking a SHA256 of a UUIDv4

Given the UUIDv4 08ab4280-0043-4630-b4c7-a5393083546c which hashes to 27fd3a1ea8a58bd06cced89927fadffbb2f4815203723e5cd4ab18acbe37b659. How feasible is it to crack a SHA256 of an unsalted UUIDv4? The ...
11
votes
5answers
3k views

Are variable time comparisons always a security risk in cryptography code?

I came across the cryptography python package, and noticed it had the following about reporting security vulnerabilities: Examples of things we wouldn’t consider security issues: Using a variable ...
0
votes
2answers
58 views

Can I increase strength of ECB by decorrelating input data with compression

I know that ECB block cipher mode is the weakest method of encryption because repetitions in input data with a stride of a block size lead to repetitions in output data. However, as I may consider, ...
0
votes
1answer
105 views

I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]

Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
0
votes
0answers
37 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
5
votes
1answer
77 views

Is there a file system allowing read-only access enforced by cryptography

Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by ...
0
votes
1answer
80 views

When encrypting password hashes, how to handle nonces?

I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
2
votes
1answer
56 views

Create shared private key

Let's have the following problem: There is something like a voting application. Every participant can cast a vote. There are more than one watchers who control the election. I want to make every ...
0
votes
2answers
89 views

What factors should I consider when choosing the key for encryption and decryption?

We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java ...
0
votes
0answers
33 views

Why does ε-differential privacy protects the subset of 1/ε edges in terms of graphs?

In the book The Algorithmic Foundations of Differential Privacy by Cynthia Dwork, Aaron Roth on page 24, databases that take the form of graphs are discussed. We could on the other hand consider ...
0
votes
0answers
44 views

Cryptograhpic hash where the hashing function input is similar to the result [migrated]

I was wondering if there is a cryptographic hash where the resulting hash is identical to the input for the hash function. If this is the case, would it be a weakness in the hashing function?
2
votes
1answer
68 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
2answers
133 views

Is it safe to encrypt some data which contains a uuid while also sending the uuid as metadata?

I have a json data-interchange format where I send messages like the following: { "revision": { "client": "f0ede1da-7314-4e59-99f7-a3a71dcab11f", patch: ["hello world", 0] }, "client": "f0ede1da-...
1
vote
1answer
62 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
55 views

What does “probabilistic algorithm with random tape” mean?

I am new to the study of cryptography, and when reading papers they often mention that "probabilistic algorithm G with random tape w ...". What does it mean by "random tape w"? I mean why it does is ...
0
votes
0answers
61 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
42 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
0answers
52 views

iOS Security Architecture-Encryption Keys

As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave. The application processor and Secure ...
0
votes
1answer
37 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
-6
votes
0answers
51 views

I want to decrypt a message, but I know anything about algorithms and key [duplicate]

This is message: 34f6e67627164757c6164796f6e63712026496e616c6970297f6570236f6d607c656475646024786963702471637b6e2
0
votes
2answers
158 views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
4
votes
2answers
245 views

Encrypting then Base64 Encoding

I notice online encryption tools encrypt the plaintext and output the ciphertext in base64 format. Why is ciphertext outputted in base64 format? Can the ciphertext be outputted in binary format?
2
votes
1answer
95 views

Is it safe to use a passphrase to seed fernet key generation?

I have a cluster deployment that depends on a Fernet Key to secure some data. The deployment script generates the key with: FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; k = Fernet....
0
votes
3answers
127 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
0
votes
1answer
155 views

What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]

I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
1
vote
1answer
104 views

Is it safe to use Orbot with the normal Firefox browser on Android

I noticed that when using Orbots "VPN Mode" that my normal Firefox browser works fine and when I visit check.torproject.org it says I'm connected even though I'm not using the Tor Browser specifically....
0
votes
1answer
41 views

Is it possible to make a crypto wallet software secure without forcing users to encrypt keys with a strong password?

I'm creating a mobile software crypto wallet. I'm not an expert, but to my understanding, no software crypto wallet is 100% secure, as it can be reverse engineered so that the private keys are exposed....
0
votes
2answers
44 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
0
votes
0answers
51 views

Advice on Site-to-Site VPN in China and protecting Intellectual Property

I know the title is an oxymoron, but our manufacturer is based in China, so I need to get as much information as possible so that management are aware of the risk/s and make this as air tight as ...
0
votes
0answers
28 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
4
votes
1answer
117 views

Is pressing random keys a secure way to seed a key generator?

There's a couple of programs that I've been using recently that ask you to type random keys as a source of randomness to seed an RNG for key generation. Is this considered a good practice still, or ...
0
votes
1answer
106 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
1
vote
1answer
53 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
1
vote
0answers
19 views

Convert python-pkcs11.types.PrivateKey to PrivateKeyInfo or PrivateKey

I'm building a CertificateListBuilder but it requires the python-pkcs11.types.PrivateKey to be an instance of asn1crypto.keys.PrivateKeyInfo or oscrypto.asymmetric.PrivateKey. How to do it? Is it ...
0
votes
2answers
108 views

What makes SoftHSM more security than other software solutions such as OpenSSL? [closed]

I see many people using softhsm just for encryption / decryption rather than using openssl.When I ask people they reply softhsm is more secure. Can anyone say in what ways softhsm is more secure.
0
votes
1answer
51 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
0
votes
1answer
71 views

Cipher that does not give confirmation whether decryption is successful

I was reading this question where the author wanted to know whether layered encryption would be better than a long password. The answers to this question all said the same thing: It would be easier ...
0
votes
0answers
23 views

Know the setting used in creating key pair in GNUPG4Win version 3.15

I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation. Basically I want to use AES-128, 3DES ...
1
vote
0answers
45 views

Does using both a counter and a random nonce make sense for the purpose of reducing the likelihood of replay attacks?

I am aware that using a counter or a random value are both acceptable ways of generating nonces, depending on the circumstances. The tradeoff with using a counter is the necessity to keep state and ...
1
vote
0answers
83 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
9
votes
1answer
596 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
0
votes
1answer
30 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
0
votes
0answers
13 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...