Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
3
votes
1answer
70 views

Why isn't it more popular to increase the p (parallelization) parameter of scrypt?

First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
1
vote
1answer
89 views

Is there a documented security standard that forbids or discourages rolling your own crypto?

Is there any security standard published by NIST or another reputed body in information security that explicitly forbids or discourages rolling your own crypto? If yes, would you please post the ...
0
votes
2answers
99 views

Is it possiable to brute force the original message of SHA-256, given the size of original string?

Given the SHA-256 hash, size and encoding of original string. Is it possible to recover the string with brute force? How many string of a given size will result in the same hash?
0
votes
1answer
50 views

Windows Certificates - where is private key located?

In Windows 10: When I load a certficate into the "Current User" store, it puts a private key file here: C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
0
votes
1answer
46 views

Understanding the Secure Multi-party circuit for Stable Matching

I am reading the following paper: MPCircuits: Optimized Circuit Generation for Secure Multi-Party Computation link of paper I have following questions: why Preference of group1 starts from L_0 ...
0
votes
1answer
60 views

Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key

If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key. This key is encoded, and sent back to the server to store ...
1
vote
0answers
57 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
0
votes
0answers
6 views

Is choosing 1 as a public key valid in the RSA algorithm? [migrated]

I know it will not encrypt anything. But is 1 valid as a public key?
2
votes
0answers
121 views

Can I use my own implementation of a widely used, supposedly secure cryptographic algorithm for securing data at rest? [migrated]

I know you shouldn't roll your own crypto and generally its not a good idea to implement (and then deploy) any extensively tested and recommended algorithms by yourself either. I have already seen ...
0
votes
1answer
56 views

SMIME email decryption using a private key - what am I doing wrong?

I have an encrypted .eml file and a private key. I've looked it up a lot on the internet but couldn't find a way to decrypt the email using OpenSSL. I've tried this command: smime -decrypt -in ...
1
vote
2answers
105 views

Is there any encryption mechanism where i can ensure that the decryption can only happen within my data center?

I have a requirement where i need to store confidential data in an encrypted format in the url, i understand POST with body is better approach but it is not an option for me. I am thinking of using a ...
-1
votes
2answers
64 views

I want to decode a string of text, but have no clue what was used to encode it [duplicate]

the text is AAAAQwAAAG8AAABuAAAAZwAAAHIAAABhAAAAdAAAAHUAAABsAAAAYQAAAHQAAABpAAAAbwAAAG4AAABz I have no idea how to decode this
0
votes
0answers
26 views

Calculating the privacy that Renyi (ε,δ) Differential Privacy satisfies

I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: εand δ. I know that the εtells us something about the probability ρ that ...
0
votes
0answers
34 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
141
votes
7answers
232k views
-1
votes
0answers
8 views

How to generate the same AES encrypted message in crypto-js? [migrated]

I tried setting iv or not setting iv, but encrypted messages were always different. import CryptoJS from "crypto-js"; const iv = CryptoJS.lib.WordArray.create([0x20212223, 0x24252627, ...
1
vote
1answer
46 views

What are the logical steps taken to perform ssh key authentication?

I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
0
votes
0answers
28 views

Would increasing the “target space” of MD5 collisions make it significantly easier to find a collision? [migrated]

This is tangential to this question, which asks about generating a file to match an exact MD5 hash. My question is if it would be significantly easier to generate a file that is "within X digits ...
1
vote
1answer
2k views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
0
votes
0answers
32 views

Is there any point in using a non-null IV for AES-GCM if the key is only used once?

I understand that re-using a key without a unique IV is a deadly sin, but what if there‘s the guarantee that the key is only used for encrypting and decrypting one dataset? I was thinking about ...
38
votes
12answers
11k views

Can a file contain its md5sum inside it?

Just wondering if it is possible to create a file which has its md5sum inside it along with other contents too.
1
vote
2answers
80 views

Detecting/preventing rollback of encrypted data on a server

I need to store a frequently-changing set of encrypted data in a database. This can be encrypted and decrypted with an internal key. The data is based upon other metrics within the system, mostly the ...
860
votes
13answers
257k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
1
vote
1answer
131 views

Did PHP's rand() get better?

I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change? In case it still does, I am using Fedora 32. PHP states in ...
0
votes
2answers
52 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
12
votes
2answers
33k views

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:...
270
votes
11answers
428k views

“Diffie-Hellman Key Exchange” in plain English

Can someone explain to me what Diffie-Hellman Key Exchange is in plain English? I have read in a non-tech news page that Twitter has just implemented this technology which allows two persons to ...
1
vote
2answers
71 views

Replay Safe Mutual Authentication (libsodium)

I am working on an end-to-end encrypted messaging application as an educational activity with some of my extra time. I have chosen to use libsodium for the underlying crypto. I have run into a hang-up ...
0
votes
1answer
52 views

Store provided external user data encrypted in the database

I hope this is the Right Place I have implemented a full user encrypted data storage solution. This works well and I can sleep well in the knowledge that neither I nor anyone else except the user can ...
2
votes
2answers
70 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
2
votes
1answer
253 views

To prove facebook end-to-end security

Is it possible to prove that Facebook Messenger's end-to-end feature is actually device-device encryption and not device-facebook-device Facebook being the man in the middle?
0
votes
1answer
70 views

Risk of issuing a client-certificate for every user in application level

I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets ...
2
votes
0answers
37 views

Should I re-timestamp old timestamps when switching to a stronger algorithm?

One of our clients uses a trusted timestamp service to prove that certain documents existed on the day they were created (they don't need a full digital signature, just the timestamp). The server uses ...
19
votes
6answers
14k views

Why do you need message authentication in addition to encryption?

I've been reading up on Authenticated Encryption with Associated Data. The linked RFC states: Authenticated encryption is a form of encryption that, in addition to providing confidentiality ...
1
vote
2answers
63 views

Signing webhooks: symmetric vs asymmetric

I want to sign webhooks so that client services can verify that a request came from my service. Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously,...
5
votes
2answers
3k views

TLS- Concept of channel binding

TLS-Handshake is based on public-key cryptography for symmetric key exchange, pki for server-authentication and assume the user authentication is realized trough username and password in the ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
2
votes
1answer
44 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
0
votes
0answers
55 views

Is AES ECB mode safe for one block Encryption then MAC with same key?

I want to do something really basic but I need to be sure that the process is safe : Problem Alice and Bob have to agree on a secret 6 digits PIN. They each have a pre-shared aes symetric key k and ...
1
vote
1answer
31 views

What affect does modulus have on CSPRNG outputs?

I work in security and I've seen modulus (modulo) used in many encoding and crypto algorithms. However, today, a friend of mine mentioned that using modulo like this: unsigned long int result = ...
2
votes
3answers
237 views

Should I chunk or not for AES-GCM file encryption

New to file encryption. Need to use AES-GCM for file encryption, can't change the alg. Heard about the max plain text size should be 64GB with same key and IV pair. Environment is python 3 with ...
3
votes
1answer
168 views

Database Security - Encryption & Searching

I am completely new to cryptography but have been trying to make myself familiar with the concepts and applications. I have a project where I believe cryptography to be beneficial. Project Info: DB =...
0
votes
0answers
52 views

Architecture of smartphone security: why FBI needed apple's help? [duplicate]

I want to focus on technical aspects, not on the fact that they wanted to make a precedence. i assume the smartphone security architecture is following: cryptography chip. it's read only and ...
0
votes
0answers
32 views

How does android boot and shows notifications with full encryption but without pre-boot authentication

i have android 5.1 (motorola moto g xt1039). i encrypted the phone and set screen password. then after every password change i can choose one of an two options: 'require the password at startup' '...
3
votes
1answer
76 views

how to associate a public key with a user of a website

I need to generate a keypair for each user registered with my website. The user already has an assigned username and password (let's assume that these credentials were assigned to the user and that he ...
1
vote
0answers
32 views

Is it possible to adjust the header size in eCryptfs?

If I understand it correctly, eCryptfs creates a file in the "lower" directory whose content is a header, plus the encryption of the file in the "upper" directory. But when I create an empty file in ...
2
votes
3answers
208 views

Should I upgrade old volumes to new cryptsetup encryption mode?

The old cryptsetup default is aes-cbc-essiv:sha256. The new one is aes-xts-plain64:sha256. I don't know that much about cryptography but I assume the standard was changed for a reason. Also there can ...
0
votes
2answers
82 views

Can I find a private key for a known encrypted file?

Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait. Once a Rasomware hits the folder and encrypts this file (...
0
votes
1answer
177 views

Public / Private Key Cryptography for offline systems

Are there any best practices around distributing an encrypted package to multiple end user systems, specially if the end system are offline ones, in context of asymetric cryptography? Is it a must to ...
1
vote
1answer
69 views

security of AES where attacker can ask secure code to decrypt arbitrary cypher-text

A service or library provides a function decrypt( user_id, cypher_text) and gives back plain text. Internally to the function it loads an AES key from a secure vault, decrypts the cypher_text, and ...

1
2 3 4 5
44