Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Security level of DSA when $q$ is a 224 bit prime? [migrated]

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
-1
votes
0answers
100 views

How that guy is currently robbing the dice2win casino? (ongoing attack) [closed]

This is about a semi decentralized full open source casino running on the Ethereum blockchain. For me when I audited the code as for the staff, everything was clear: the gambling games being run ...
1
vote
2answers
83 views

How are passwords stored in the database of a decentralized peer to peer system?

I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
0
votes
2answers
54 views

Key derived from source files; deduplicated file storage

I'm wondering if the following system would be a secure way to store frequently duplicated files. Hash the source file, deterministically derive a key from it. The source file(s) are likely to be ...
0
votes
0answers
26 views

DSA parameter selection [migrated]

In the Digital Signature Algorithm, is there a reason why the larger prime parameter should be an $N$-bit prime where $N$ is a multiple of 64 ? Is this strictly necessary for proper working of the ...
-1
votes
0answers
13 views

how is bitcoin network protect itself from malicious nodes? [migrated]

Can someone explain how does Bitcoin network protect itself from malicious nodes? Lets say someone creates bitcoin core clone and they manipulate it to their need. For example could someone change ...
0
votes
0answers
17 views

Who provides prime numbers for cryptographic protocols? [migrated]

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
2
votes
2answers
48 views

Is it possible to create a certificate for a key pair which I do not possess?

Perhaps the answer is no, and perhaps this is a dumb question. However I am trying to understand the underlying principles better. My understanding of certificate signing process. I generate a key ...
0
votes
0answers
44 views

WordPress, a Security Risk for Bitcoin Application?

Asked this question on Bitcoin SE was told to post it here. I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
0
votes
1answer
84 views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
2
votes
0answers
34 views

Key Exchange using RSA public key without a certificate

I want to share AES key using RSA. What is the recommended/widely used format for encrypting the AES key and its attributes with the public key? I know that PKCS#7/CMS enveloped-data allows encrypting ...
1
vote
0answers
132 views

Digital Signature uses private key for encryption, and public key for decryption? [duplicate]

Public key is for encryption, and private key is for decryption in PKIs. And digital signature employs the PKIs. How to use a private key for encryption, and using public key for decryption which ...
0
votes
0answers
35 views

Advise a data encryption scheme/model

I have wondered around and am unable to come out with a proper solution for the below requirements, would seek your kind advice. It is similar to Which strategy to encrypt data accessed by multiple ...
-2
votes
2answers
64 views

Encryption layers

I'm curious, as a green programmer, if one used layers of encryption methods, would this be more difficult to crack or impossible? Example: Layer 1- encryption method 1 "Encrypt this string" ...
2
votes
1answer
92 views

Why AES output has more size than my plaintext?

I have enciphered a vector of bytes that has 17 bytes in itself. However, When I try to enciphered with AES, AES output has a 32-byte size? What is happening here?
1
vote
0answers
68 views

Why is a password encrypted with AES and then sent back to the server together with the key with RSA (Instagram)?

I am trying to understand an encryption process on a website (Instagram). As far as I know, a public key is sent from the server to the client. Then the password is encrypted with AES_GCM_256 and ...
0
votes
1answer
111 views

Did The Wire invent the “Jump 5” cipher?

N.B. Asking this here instead of Movies.SE because I'm wanting to know about the cipher itself and any history, which this site is more suitable for. In S01E05 of The Wire, at around 45:00, it's ...
0
votes
0answers
18 views

How to connect Windows CNG with Nginx in order to protect server private keys?

As I read on this question, private keys are protected by CNG mechanisms in Windows. So using NGINX, I would like to know how to establish the communication between NGINX and this cryptographic API in ...
-2
votes
1answer
83 views

Keyless entry system

To what extent can cryptography help protect against relay attacks (on vehicles)?
1
vote
2answers
58 views

Why our key and our plaintext should have a same size in One Time Pad

I was reading Serious Cryptography book. I am a newbie in cryptography field who try to learn as possible as he can. In this book, there is the following section of phrases: For example, if a ...
0
votes
1answer
74 views

Calculate AES-GMAC

I have a symmetric key and I have the data that needs to be authenticated. So one of the solution that I have in mind is to use the AES GMAC. I know there are other MAC's such as HMAC or hash ...
0
votes
2answers
80 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
79 views

E2E Encrypting User Data [closed]

I'm building an end-to-end encrypted web-app. I plan to use ECDH + P256 curve for generating private/public keys. The private keys are saved onto the user's computer and the public keys are stored on ...
1
vote
1answer
65 views

Is Python's `secrets` module using the same code as the `random` module?

The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
2
votes
1answer
100 views

How to make sure the GPG's home directory is safe?

I am a novice with cryptography. I am studying the GPG for encryption of my backup files. My current understanding is that the keys are saved in the home directory of GPG. And it means that if someone ...
1
vote
1answer
45 views

How to create same ssh key pair on different systesm at different times

Was going through the SSH key pair generation and did tried with the few systems i have. refer to the below command and the thumbprint value post key pair generation. $ ssh-keygen.exe -t rsa ...
2
votes
1answer
117 views

Python generated RSA keys looks the same

I'm working on a sharing protocol, and the handshake, authentication etc. is done with RSA keys. By default I use 4096 bit keys, but it seems the beginning and end of any key generated are the same, ...
1
vote
1answer
39 views

How am I supposed to use a revocation certificate, and can there be multiple revocation certificates for the same private key?

I just generated a revocation certificate for my key. Unfortunately I don't fully understand the concept. Here are my questions: How exactly am I supposed to use it? Suppose for example that my ...
1
vote
1answer
89 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
0
votes
0answers
22 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
0answers
28 views

Remote digital signature (eidas)

Except the usual implementations of a digital signature there is the "remote" digital signature implementation (is a standard created by eidas). There are some companies that provides remote ...
1
vote
0answers
27 views

Can I read environment process variables of a react client in a browser?

I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
2
votes
1answer
76 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
3
votes
1answer
83 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
1answer
64 views

How to generate ffdhe from rfc7919

Everyone recommends to use the pre-defined ffdhe groups from https://tools.ietf.org/html/rfc7919 There are multiple sources (for example mozilla) where I can download the DH PARAMETERS file but how ...
0
votes
0answers
33 views

Cryptocurrency recovery passphrases in the cloud?

Currently, my recovery passphrases are just handwritten on a bit of paper. I know myself and don't feel very confident that I'll still know where that paper is when I need it in however many years. So ...
2
votes
0answers
67 views

Compiler-induced information leaks/side-channels in cryptography implementations

In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits. ...
0
votes
0answers
59 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
1answer
91 views

Help identify a simple, reversible cipher/encryption algorithm [duplicate]

I'm trying to help a small business transition out of an obsolete, obscure piece of software, and app support is, unfortunately, non-existent. To fully export the data for the new system, I need to be ...
2
votes
2answers
85 views

With AES, does key format make a difference to security?

For context, I'm assuming the attacker knows the format of the key. Do these two keys have the same strength, or by leaving the hyphens in the key am I reducing the security by a partly-known-key ...
1
vote
1answer
77 views

Public key encryption with modified private key requried

I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate ...
-1
votes
1answer
119 views

How does Zero Knowledge Proof prevent lying?

I have seen and read several videos and articles that try to explain how Zero Knowledge Proof systems work. In these examples, there is a verifier of information, and a prover of information. The ...
0
votes
1answer
78 views

Symmetric encryption - given plain text, produce cipher text without key

Suppose Alice and Bob are communicating using a peer-reviewed symmetric encryption algorithm such as AES-256. Bob possesses a private encryption key to decode messages from Alice, but Alice does not ...
1
vote
5answers
199 views

Attacks Relying on Poor Entropy

I'm creating a quantum random number generator as part of my thesis. As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
2
votes
1answer
143 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
0answers
76 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
1
vote
1answer
84 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
1
vote
0answers
60 views

Are these tests enough to check if a web app is vulnerable to Padding Oracle? How to test further?

SCENARIO: a web application using with ASP.NET. In the home page source code there are links like: ./WebResource.axd?d=[string with 87 characters] ./ScriptResource.axd?d=[string with 172 characters] ...
0
votes
1answer
33 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...

1
2 3 4 5
45