Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
1answer
73 views

Help identify a simple, reversible cipher/encryption algorithm [duplicate]

I'm trying to help a small business transition out of an obsolete, obscure piece of software, and app support is, unfortunately, non-existent. To fully export the data for the new system, I need to be ...
2
votes
2answers
64 views

With AES, does key format make a difference to security?

For context, I'm assuming the attacker knows the format of the key. Do these two keys have the same strength, or by leaving the hyphens in the key am I reducing the security by a partly-known-key ...
1
vote
1answer
71 views

Public key encryption with modified private key requried

I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate ...
0
votes
0answers
38 views

Block cipher exercise CTR, CBC and ECB [closed]

I'm trying to figure out this exercise about CTR, CBC and ECB given Encryption Matrix [29->0, 11->1, 26->2, 1->3, 21->4, 4->5, 15->6, 31->7, 27->8, 28->9, 2->10, 14-&...
-1
votes
1answer
100 views

How does Zero Knowledge Proof prevent lying?

I have seen and read several videos and articles that try to explain how Zero Knowledge Proof systems work. In these examples, there is a verifier of information, and a prover of information. The ...
0
votes
1answer
62 views

Symmetric encryption - given plain text, produce cipher text without key

Suppose Alice and Bob are communicating using a peer-reviewed symmetric encryption algorithm such as AES-256. Bob possesses a private encryption key to decode messages from Alice, but Alice does not ...
1
vote
5answers
143 views

Attacks Relying on Poor Entropy

I'm creating a quantum random number generator as part of my thesis. As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer ...
8
votes
3answers
2k views

What happens when I encrypt something with my RSA Public Key?

I know encrypting something with my private key is used for signing. To prove that the message is indeed coming from me. But what about if I sign something with my public key? That would mean that ...
2
votes
1answer
104 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
0
votes
0answers
72 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
1
vote
1answer
73 views

Does a TPM replace the default device's security, or add to it?

Does a TPM replace the default device's security, or add to it? I will try to re formulate it into 2 questions, just to explain what my question is, since I am not very good at English writing. If we ...
0
votes
0answers
8 views

What's the difference between digest algorithm and signing algorithm? [migrated]

I'm reading rfc5652, there are different references of the two algorithm identifiers. For example in this ASN.1 structure : https://tools.ietf.org/html/rfc5652#section-5.3 When using RSA for signing; ...
1
vote
0answers
42 views

Are these tests enough to check if a web app is vulnerable to Padding Oracle? How to test further?

SCENARIO: a web application using with ASP.NET. In the home page source code there are links like: ./WebResource.axd?d=[string with 87 characters] ./ScriptResource.axd?d=[string with 172 characters] ...
0
votes
0answers
24 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
1
vote
1answer
100 views

How to decrypt a ciphertext encrypted in AES CTR mode if you are given ciphertext, plaintext, and key?

Question is the title. To give a bit more information, the same key is used for all ciphertexts and I know ciphertexts C1 and C2 and plaintext P1, which corresponds with C1. The incrementing method ...
0
votes
1answer
59 views

Vulnerabilities and potential scale for sensitive data transferred in plaintext, involving credit card payment information

Regarding the insecure transmission of data over a network. When it comes to plaintext credit card information and payment details being transferred in this manner over HTTPS. What are the possible ...
0
votes
1answer
66 views

How does Telegram's secret-splitting scheme work?

The Telegram FAQ's state that they are not able to comply with court orders from one country alone because they "split the encryption keys and spread them over multiple jurisdictions". To ...
3
votes
0answers
70 views

How could the “unhackabilty” of quantum Internet justify its cost? [closed]

The U.S. Department of Energy (DOE) seems to be very excited about the potential of a quantum Internet: One of the hallmarks of quantum transmissions is that they are exceedingly difficult to ...
0
votes
1answer
56 views

Detection of Substitution attack on Block Cipher ECB mode

This is from Christoff Paar's book on Cryptography Let’s assume a protocol for wire transfers between banks (Fig. 5.2). There are five fields which specify a transfer: the sending bank’s ID and ...
3
votes
1answer
94 views

Can I HMAC my plaintext for use as a NACL SecretBox nonce?

I'm writing an application that needs to deterministically encrypt some data (where two equal ciphertexts will produce two equal plaintexts; this is acceptable and in fact desirable for this ...
0
votes
1answer
52 views

Methods to Prove Data Authenticity from Potentially Compromised Sources?

I've been thinking about this problem for some time and I wanted to ask if there are any known methods, or research papers, about how to prove "authenticity" or correctness of data ...
0
votes
1answer
57 views

Does attacking difficulty of a block cipher depend on it's block length?

Does attacking difficulty of a block cipher depend on it's block length compared to a substitution cipher?
0
votes
1answer
47 views

Best practice for encrypting data on Mifare

I am currently playing around with Mifare Classic 1k. And everything I have read about it's security is true. So it's not exactly the best thing to use to avoid cloning. But I was wondering if someone ...
0
votes
1answer
70 views

Diffie Hellman implementation- NodeJS

Diffie Hellman is a key exchange algorithm where client and server both generate public and private key, exchange their public key and combine this key with his own private key to generate same secret ...
0
votes
0answers
87 views

How to decrypt encrypted SAML assertion using private RSA key?

Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
0
votes
3answers
131 views

Why can't we encrypt the message with sender's private key and receiver's public key in case of sending messages through a server?

I read that why do we need E2EE and can't rely only on HTTPS for sending messages through a messaging app. The reason which i understood is when sender sends the message to the server, the TLS ...
1
vote
2answers
76 views

Using timingSafeEqual

I've seen code like this: if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword)) So timingSafeEqual is supposed to use the same amount of time to ...
1
vote
0answers
70 views

How smart cards are blocked?

I have a Yubikey NFC 5, when I enter a wrong PIN or PUK three times the smart card is blocked. Can someone please explain to me how it is blocked ? Does the PIN/PUK functionality is disabled somehow ? ...
0
votes
0answers
53 views

the difference between SSL pinning and using just HTTPS connection [duplicate]

I know that if i used HTTPS the connection will established after the handshake so (the user will ping the the link then the server will give him public key so the client can provide him with ...
0
votes
0answers
23 views

How to decrypt cipher text without knowing the algorithm used to encrypt it? [duplicate]

The following is the encrypted text: EzKFKgakD7OXpc57py63jCSz9ICVWBxneruHDPqsVDhxDQElGztZwbyOx8Z/mV7GrzMzoCYHeaOCu81gHRzg4aIEusQCuPpoSFqgfhAKKniJYKW108KsVMdb2hmuax/fLCE+pr2ltRD+...
0
votes
1answer
61 views

Where and how to store admin account credentials for enterprise systems?

To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
0
votes
2answers
146 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
0
votes
0answers
22 views

Existing standards for Merkle tree based proof schemes?

I'm sketching an idea of proof of deposit for my company. The goal is to prove that daily billing documents are timestampped and not changed since that time. Solutions exists, based on Merkle proofs ...
0
votes
1answer
88 views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
0
votes
1answer
66 views

pki infrastructure for REST API

My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption. The steps ...
0
votes
1answer
68 views

What's a secure way to generate a keypair from a secret password?

I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then ...
0
votes
1answer
275 views

John The Ripper and PBKDF2-HMAC-SHA1

I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
0
votes
1answer
48 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
115 views

Performance comparison between ed25519 vs AES

I found that AES has dedicated hardware on most machines. The question is can we use ed25519 to replace AES? Instead of using RSA to encrypt the AES key and then encrypt the data with AES, can we just ...
0
votes
0answers
43 views

Facebook/Google OAuth - need a constant string for E2EE

The clients can use Google and Facebook OAuth for authentication I need to implement a chat application where the messages are end-to-end encrypted When the user changes device, the client should be ...
4
votes
1answer
79 views

Why isn't it more popular to increase the p (parallelization) parameter of scrypt?

First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
1
vote
1answer
97 views

Is there a documented security standard that forbids or discourages rolling your own crypto?

Is there any security standard published by NIST or another reputed body in information security that explicitly forbids or discourages rolling your own crypto? If yes, would you please post the ...
0
votes
1answer
194 views

Windows Certificates - where is private key located?

In Windows 10: When I load a certficate into the "Current User" store, it puts a private key file here: C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
0
votes
2answers
253 views

Is it possible to brute-force the original message of SHA-256 given the size of original string?

Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
1
vote
0answers
63 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
1
vote
2answers
125 views

Is there any encryption mechanism where i can ensure that the decryption can only happen within my data center?

I have a requirement where i need to store confidential data in an encrypted format in the url, i understand POST with body is better approach but it is not an option for me. I am thinking of using a ...
-1
votes
2answers
65 views

I want to decode a string of text, but have no clue what was used to encode it [duplicate]

the text is AAAAQwAAAG8AAABuAAAAZwAAAHIAAABhAAAAdAAAAHUAAABsAAAAYQAAAHQAAABpAAAAbwAAAG4AAABz I have no idea how to decode this
0
votes
0answers
39 views

Calculating the privacy that Renyi (ε,δ) Differential Privacy satisfies

I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: εand δ. I know that the εtells us something about the probability ρ that ...
0
votes
0answers
39 views

need to address a subset of CIA triad elements and not in entirety

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...

1
2 3 4 5
45