Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

Should i upgrade old volumes to new cryptsetup encyption mode?

old cryptsetup default is es-cbc-essiv:sha256. the new one is aes-xts-plain64:sha256. i don't know that much about cryptography but i assume the standard was changed for a reason. also there can be ...
1
vote
2answers
60 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
36 views

Does Windows CNG Keystore supports exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
6
votes
2answers
1k views

How to encrypt using a private key file generated by OpenSSL?

When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key ...
2
votes
1answer
114 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
2answers
64 views

Convert ECDSA keys (PEM, OpenSSH)

To work with ECDSA keys I am using the python-ecdsa library. Unfortunately this library can not process keyfiles properly if they are provided in the OpenSSH format. Instead I generate them in the PEM ...
1
vote
2answers
914 views

Does Thunderbird Enigmail plugin decrypt attached files?

From my research I have found out that you can easily send encrypted messages to one another using Enigmail. If first I encrypted a file,then attached it to an email, sending it through Enigmail to a ...
0
votes
1answer
41 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
2
votes
1answer
114 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
2
votes
1answer
52 views

RSA key size in TLS ciphersuite with RSA key exchange

I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits) I understand that the RSA algorithm is used here for for key exchange, as ...
0
votes
1answer
125 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
3
votes
2answers
6k views

Disable support for static key cipher suites

I have a requirement to disable in the windows 7 computers of the company the support for static key cipher suites. I have searched and found that this registry key, holds the allowed cipher suites, ...
-1
votes
2answers
47 views

technical difference between TLS and a certificate [duplicate]

I don't quite understand what the difference is between TLS and a certificate. TLS secures the transmission by encrypting the data. So normally no man in the middle attack is possible and nobody else ...
1
vote
2answers
60 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
-1
votes
1answer
30 views

Openssl CLI AES-XTS and AES-CCM support

Is there anyone out there who have tested AES-CCM and AES-XTS using openssl CLI. ? Whether openssl supports AES-XTS? I was having a backup plan of creating custom API if CLI does not supports XTS and ...
0
votes
0answers
27 views

How to customize default enabled EC curves or the curves preference in Azul Zulu JDK

We use Zulu JDK and want to customize the default enabled EC curves. Oracle JRE provides this using jdk.tls.namedGroups system property in java.security. https://www.oracle.com/technetwork/java/...
0
votes
1answer
55 views

Updating Sender-Keys and Key-Management

This question is related to an earlier question I had: Encryption on Mobile Devices - Multiparty Encryption - Key Management My situation: I have many mobile devices that want to send sensitive ...
1
vote
1answer
82 views

Digital Footprint Law

Can anyone help me with the name of the digital footprint law? All I know is that it is named after its discoverer much like Moore's Law is. This is a computer science law that states for the purposes ...
1
vote
1answer
99 views

Encryption on Mobile Devices - Multiparty Encryption - Key Management

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
0
votes
1answer
46 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
2
votes
1answer
75 views

Is getting 1-2 outputs from a CSPRNG to seed another CSPRNG less entropy than getting say 5000 outputs from a CSPRNG and using that to seed?

This question builds off of this question. I want to create more entropy from a viable entropy source to seed another CSPRNG. If I use window.crypto.getRandomValues(newUint8Array(1)) To seed a ...
8
votes
1answer
271 views

How are Mozilla Firefox passwords encrypted?

As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions). ...
9
votes
4answers
1k views

What good, standard digital signature / timestamp verification clients are widely or easily deployed?

I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify via software run locally on public data. For example, ...
35
votes
7answers
16k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
8
votes
2answers
2k views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
0
votes
1answer
69 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
5
votes
2answers
19k views

Mifare DESfire EV1 cloning?

How can I clone an encrypted Mifare DESfire EV1 Card? Tried a 13.56Mhz Reader/writer from eBay but didn't work properly... I need to find any possible way of doing this.
34
votes
1answer
5k views

How does OpenSSL generate a big prime number so fast?

In order to generate a 2048 bit RSA key pair, you need to generate two big prime numbers with 1024 bits length. As far as I know, OpenSSL chooses a random 1024 bit number and starts looking for a ...
2
votes
1answer
7k views

Can you recover the password from ZipCrypto encrypted ZIP file?

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily. Now the question is, can you also get at the password (assume this is a very long, very high ...
226
votes
11answers
44k views

Why is Math.random() not designed to be cryptographically secure?

The JavaScript Math.random() function is designed to return a single IEEE floating point value n such that 0 ≤ n < 1. It is (or at least should be) widely known that the output is not ...
4
votes
1answer
328 views

Secret Santa - implementation that does not require a participant to trust the server

In the Christmas spirit I read Cryptographic Secret Santa from MathOverflow, and then followed the link to another page titled Cryptographic Secret Santa. On this latter page the author explains an ...
3
votes
2answers
1k views

Can TPM “Storage Keys” be created outside the TPM?

I am interested in 'adding' preexisting keys to a TPM's storage hierarchy. An example of a desired key hierarchy can be shown as: (SRK)----->(User Storage Key)-------> User Working Key 1 ...
1
vote
3answers
87 views

What is the advantage of using a digital signature over simple asymmetric encryption?

If you're sending me a message, you can: a) Encrypt the message using your private key, and I can decrypt is using your public key. b) You can create a digital signature of your message, and then ...
26
votes
1answer
6k views

What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase?

Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks? WPA/WPA2 Enterprise using 2048-bit RSA public-key WPA/WPA2 Personal using 63-character ...
1
vote
1answer
87 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
5
votes
2answers
1k views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
15
votes
5answers
18k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
0
votes
0answers
42 views

Public blockchain, encrypted blocks with access list; Key revocation; Is it a fit for attribute based cryptography?

I've got the requirement to put the company data onto blockchain for traceability and auditability. Some of that data is public, whilst some of this data is confidential to 1+ (could be many) user ...
97
votes
6answers
36k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
0
votes
1answer
133 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
1
vote
1answer
90 views

Would Hashing a Decryption Key Significantly Lower Security? [duplicate]

I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
32 views

Help me to identify what type of string it is? [duplicate]

70373f65f945e5184dcb42793cbe2cddb34248ef172b7ddb5e27467fd8d76314ea8bdeb19226687ac0ca01e646dbe8fdb4dfb2d6816f54b9b500639ac6c3bf056fbd4c45a246bbe66e6fd0ce3730801716b12fff942207933e1bb6386806d476ade6f5b1 ...
2
votes
3answers
164 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
0
votes
1answer
91 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
2
votes
2answers
99 views

How to protect data integrity in IoT network? [closed]

The security of IoT devices is very important to protect the data uploaded by IoT devices. Because if an attacker force an IoT device to upload misleading/false data, the analytics and insights ...
831
votes
13answers
234k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
0
votes
1answer
77 views

Find seed used in Math.random LCG given a list of outputs [duplicate]

Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is ...
0
votes
0answers
94 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
0answers
62 views

How to determine the encoding used when you have the data not the source code [duplicate]

The source code converts the data as below: 00000 - 62F0CBA67EA6A2C03D399A1B06D82787CB46480370FDA0C1CF5016E59A61F0A6 000000 - F657FC2120036C2EF29AF87E4194539B1728AB2F204676E413C6FFD5970453B9 ...
0
votes
2answers
142 views

How do you use a public key to encrypt a string

I am oversimplifying but I understand that a public key is the product of two large prime numbers. In essence as long as the private key is kept private, the owner knows something that the outside ...