Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
19
votes
1answer
5k views

Collision rate for different hash algorithms

Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)? If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
5
votes
2answers
3k views

Can RSA (or any public/private key algorithm) be repeated for large amounts of data?

I'm working on a small security assignment and I was instructed to implement simple encryption/decryption of files using RSA in C#. When attempting to encrypt/decrypt large files, I was informed by ...
0
votes
1answer
167 views

Enterprise and Open Cryptographic Systems/Applications?

Please can someone tell me the main Enterprise/Open Cryptographic Systems in use, I am having a hard time googling for them. I know OpenPGP is one, but is that the best and most ubiquitous one for ...
2
votes
2answers
493 views

What is the correct way to assess and compare Certicom's products to the alternatives?

I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
9
votes
3answers
2k views

Is it possible to have authentication without state

In order to login to most websites you need a username and password which is often stored in a SQL database. You are storing per-user information that can change, this is state. Can you prove that ...
6
votes
1answer
227 views

Wireless auto-join on laptops

Maybe I have the wrong idea but this is a question that has been floating in my head for some time. Whenever you use an iPhone (or a Mac, Apple products seem to be more prone to this because it ...
6
votes
3answers
2k views

Is there a way to accept signed requests without storing client's password in plaintext?

We are developing REST Web service. We will give Identifier and Secret string to each of our REST clients. When doing requests, clients will authenticate themselves using HMAC algorithm (they will ...
11
votes
1answer
3k views

TLS replay attack - requirements of the serverHello nonce

As you all know, the SSL/TLS protocol requires both client and server to exchange (in clear text) a random number or nonce. This is presumably used to prevent replay attacks. It is not clear to me ...
14
votes
2answers
819 views

Is a large number of RSA-encrypted files a vulnerability?

Would having a large number (10^4) of RSA encrypted files make it easier for an attacker to find my private RSA key? Update: These files would be available to the attacker, and perhaps the content of ...
14
votes
5answers
4k views

Do mobile OS's provide crypto-quality randomness?

Which mobile OS's provide a primitive to generate crypto-quality randomness that applications can use? On desktop systems, these features are pervasive. Unix provides /dev/urandom. Windows provides ...
6
votes
3answers
2k views

Certificate chain

For my computer to verify the identity of a certain certificate should it have all the certificates up to the root certificate?
3
votes
1answer
322 views

What is encryption method for the 3rd part of the Kryptos text?

http://fr.wikipedia.org/wiki/Kryptos_%28sculpture%29 http://en.wikipedia.org/wiki/Kryptos I read the Kryptos wikipedia page, is says it's crypted with a "modular transposition of lines and columns". ...
8
votes
1answer
1k views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
6
votes
2answers
941 views

How effective is the Mac Open Firmware password protection?

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff. [assuming a good password] Would does the firmware password ...
8
votes
2answers
2k views

Classical Cryptography Tools

I'm wondering if there are any tools out there that can assist in solving classical cipher text. I'm looking into developing some tools such as frequency analysis, transposition tools and so on but ...
6
votes
3answers
744 views

Personal digital certificate how to verify

A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the ...
3
votes
1answer
175 views

Protect file in a web site

How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
5
votes
1answer
352 views

When does one need to be concerned with leaking timing information in .NET?

According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison. When working with .NET crypto classes, when should ...
2
votes
2answers
261 views

What are the advantages of sequential signing

What the advantage of sequentialy signing a document? That means signing a document by two people in a sequential manner?
4
votes
1answer
994 views

Why does Bouncy Castle have a separate download for the IDEA algorithm?

I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not. http://www.bouncycastle.org/csharp/ Why ...
4
votes
1answer
6k views

How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data? My goal is to allow my application to ...
30
votes
3answers
13k views

Forced into using a static IV (AES)

We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
15
votes
5answers
793 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
0
votes
1answer
2k views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
12
votes
1answer
555 views

What are the problems with encrypted but unsigned data?

In another question's answer, D.W. wrote: Make sure there is authenticity protection for the encrypted data (e.g., encrypt and then sign/MAC): you will need both confidentiality and authenticity ...