Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

0
votes
0answers
22 views

What is the problem of increasing the time encryption of my stream cipher algorithm? [on hold]

I have my own stream cipher algorithm, and I made a comparison between it and AES performance. I tested it on several files with different sizes (to 500KB). Its encryption/decryption time is less than ...
0
votes
1answer
24 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
0
votes
1answer
50 views

Cipher that does not give confirmation whether decryption is successful

I was reading this question where the author wanted to know whether layered encryption would be better than a long password. The answers to this question all said the same thing: It would be easier ...
0
votes
0answers
14 views

Know the setting used in creating key pair in GNUPG4Win version 3.15

I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation. Basically I want to use AES-128, 3DES ...
0
votes
0answers
27 views

How to calculate XOR functions? [on hold]

I want to know how to calculate from first principles the following XOR function: (A XOR B) XOR (C XOR B)
1
vote
0answers
31 views

Does using both a counter and a random nonce make sense for the purpose of reducing the likelihood of replay attacks?

I am aware that using a counter or a random value are both acceptable ways of generating nonces, depending on the circumstances. The tradeoff with using a counter is the necessity to keep state and ...
1
vote
0answers
30 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
2
votes
0answers
63 views

DES/AES invertibility [migrated]

My professor has posted a couple of practice questions that so far I haven't been able to find the answer for and I was hoping you could help. DES would remain invertible—it would still be ...
-1
votes
0answers
22 views

Thunderbird doesn't detect my S/MIME certificate [closed]

I created a certificate backup that came from the browser and saved it on the desktop. But when I try to import it at Mozilla Thunderbird it says "Certificate Manager can't locate a valid certificate ...
-2
votes
0answers
49 views

Free S/MIME Certificates [closed]

where I can get free S/MIME certificates? I tried applying for sectigo/comodo and Its been 3 days and I haven't receive the certificate yet. Also how do I encrypt gmail, without having GSuite.
0
votes
0answers
45 views

Can't understand specific cryptographic based symmetric algorithm, how to solve? [closed]

I am working on a cryptographic based symmetric algorithm. But before that's, I have to make software code in java for a previous proposed algorithm. The algorithm that's i have to solve looks like: ...
9
votes
1answer
541 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
0
votes
1answer
25 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
0
votes
0answers
9 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
1
vote
1answer
57 views

What are a keypair and a public key ring?

The GNU Privacy Handbook says: The command-line option -gen-key is used to create a new primary keypair. gpg --gen-key Does a keypair mean a pair of private key and public key? The book also ...
0
votes
1answer
42 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
4
votes
1answer
59 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
0answers
44 views

IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]

I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
1answer
27 views

Can Honey Encryption be used for CAN bus security? [closed]

AES encryption was one of the best encryption techniques used but it had a major disadvantage that it cannot handle brute force attack. Hence honey encryption was introduced which can handle brute ...
1
vote
1answer
36 views

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding....
0
votes
2answers
80 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...
0
votes
1answer
56 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
1
vote
2answers
75 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
3
votes
1answer
86 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
0
votes
2answers
46 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
2
votes
1answer
88 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
0
votes
0answers
87 views

Fix use of hardCoded Cryptographic key

I have a method that obtains the secret key to be able to encrypt with AES.The secret key is stored in database. As seen in the method, I use a Stored procedure to get the secret key value and assign ...
-5
votes
1answer
74 views

Can someone tell me what is this encryption method? [duplicate]

DQUC//S+y9uZxanuAS0WTQBlAG4AZQBkAHwBZQByACAAegBhAGQAYQBEASAAVwBpAG4AZABvAHcAcwAC3/...
1
vote
1answer
73 views

Deniable proof of authorship

The title may read like a contradiction, but I would like to know whether a cryptographic solution exists to the following problem: Problem statement Suppose Alice wants to write a document using a ...
3
votes
1answer
61 views

How do GnuPG smartcard generate reliable random data?

I'm generating a private key on my new GPG smartcard at this very moment. On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc. How does ...
2
votes
1answer
109 views

If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]

PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"
0
votes
0answers
41 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
3
votes
1answer
111 views

Is it possible to fake ECDSA signatures?

Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs. https://www.reddit.com/r/btc/comments/9xpivk/...
4
votes
2answers
401 views

A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean?

Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence ...
3
votes
1answer
71 views

How much less secure is a password with a repetitive pattern of characters?

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient. So my idea is to just use a short password and repeat it a few times like this: ...
1
vote
1answer
68 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
2
votes
2answers
62 views

Use combination of digital certificates and symmetric key cryptography

Assuming that: - A have CertA and secret key KsA - B have CertB and secret key KsB A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must ...
0
votes
1answer
74 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
4
votes
4answers
317 views

Can I use a user's password hash as the AES key to make a one time token?

I want to make a one time token that users use to reset their password. The token should be invalidated once it is used, is it safe to use their currently hashed password as the aes key to encrypt the ...
2
votes
1answer
64 views

Which high speed / high security ECC curves are preferred on mobile devices?

I'm looking for the most common denominator of ECC curves in consumer devices. This article describes how a particular ECC curve is ideal for Intel based motherboards. Since I'll be targeting mobile ...
0
votes
2answers
103 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
1
vote
1answer
106 views

Authenticate that I am the poster of a certain anonymous message

I'm a programmer, and I've made a nifty script that scours a certain internal forum site. Messages posted on the forum are all anonymous, so I'm wondering how exactly I can get my script to realize ...
1
vote
0answers
42 views

Identifying and understanding a cryptographic voting protocol

I am reading about a voting protocol using public key encryption. According to the notes, if A votes va, then A broadcasts Ra(Rb(Rc(Ea(Eb(Ec(va)))))). Here, Ra is a random encoding function which ...
8
votes
4answers
167 views

How much security expertise does a general application programmer need to develop software ethically? [closed]

I am curious about this. I saw this thread: Why shouldn't we roll our own? and this answer: https://security.stackexchange.com/a/18198/144241 which had on it this comment, which had the second ...
2
votes
5answers
139 views

Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk?

Situation as follows: Let's assume two (or more) containers, encrypted using the same passphrase. They will contain the same files. So their content is identical. However, (from "outside") the ...
6
votes
4answers
232 views

Are there any practical attacks on random number generators?

I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section. ...
1
vote
2answers
313 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
2
votes
1answer
52 views

How to use login details to make a key for AES encryption and decryption

I have recently starting looking into AES encryption for a side project. I am researching this till now so if there is something wrong about my concept please correct it. According to me If i want to ...
0
votes
1answer
88 views

Decrypt AES 128 CTR with the IVs (counter) but not the key

I have the encrypted files, the random IV for each encrypted files and the counter increment function but I miss the key. Is there anyway for me to decrypt the files?