Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [cryptography]

Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for password storage) and digital signatures (provable integrity and authenticity with non-repudiation).

Filter by
Sorted by
Tagged with
3
votes
1answer
87 views

Using same algorithm for signing and encrypting a message

If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?
0
votes
2answers
158 views

Is it safe to encrypt some data which contains a uuid while also sending the uuid as metadata?

I have a json data-interchange format where I send messages like the following: { "revision": { "client": "f0ede1da-7314-4e59-99f7-a3a71dcab11f", patch: ["hello world", 0] }, "client": "f0ede1da-...
1
vote
1answer
171 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
68 views

What does “probabilistic algorithm with random tape” mean?

I am new to the study of cryptography, and when reading papers they often mention that "probabilistic algorithm G with random tape w ...". What does it mean by "random tape w"? I mean why it does is ...
0
votes
0answers
430 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
52 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
0answers
67 views

iOS Security Architecture-Encryption Keys

As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave. The application processor and Secure ...
0
votes
1answer
39 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
2answers
248 views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
4
votes
2answers
575 views

Encrypting then Base64 Encoding

I notice online encryption tools encrypt the plaintext and output the ciphertext in base64 format. Why is ciphertext outputted in base64 format? Can the ciphertext be outputted in binary format?
2
votes
1answer
250 views

Is it safe to use a passphrase to seed fernet key generation?

I have a cluster deployment that depends on a Fernet Key to secure some data. The deployment script generates the key with: FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; k = Fernet....
0
votes
3answers
153 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
0
votes
1answer
170 views

What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]

I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
1
vote
1answer
444 views

Is it safe to use Orbot with the normal Firefox browser on Android

I noticed that when using Orbots "VPN Mode" that my normal Firefox browser works fine and when I visit check.torproject.org it says I'm connected even though I'm not using the Tor Browser specifically....
0
votes
1answer
42 views

Is it possible to make a crypto wallet software secure without forcing users to encrypt keys with a strong password?

I'm creating a mobile software crypto wallet. I'm not an expert, but to my understanding, no software crypto wallet is 100% secure, as it can be reverse engineered so that the private keys are exposed....
0
votes
2answers
78 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
0
votes
0answers
238 views

Advice on Site-to-Site VPN in China and protecting Intellectual Property

I know the title is an oxymoron, but our manufacturer is based in China, so I need to get as much information as possible so that management are aware of the risk/s and make this as air tight as ...
0
votes
0answers
29 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
4
votes
1answer
134 views

Is pressing random keys a secure way to seed a key generator?

There's a couple of programs that I've been using recently that ask you to type random keys as a source of randomness to seed an RNG for key generation. Is this considered a good practice still, or ...
0
votes
1answer
133 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
1
vote
1answer
73 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
1
vote
0answers
83 views

Convert python-pkcs11.types.PrivateKey to PrivateKeyInfo or PrivateKey

I'm building a CertificateListBuilder but it requires the python-pkcs11.types.PrivateKey to be an instance of asn1crypto.keys.PrivateKeyInfo or oscrypto.asymmetric.PrivateKey. How to do it? Is it ...
0
votes
2answers
432 views

What makes SoftHSM more security than other software solutions such as OpenSSL? [closed]

I see many people using softhsm just for encryption / decryption rather than using openssl.When I ask people they reply softhsm is more secure. Can anyone say in what ways softhsm is more secure.
1
vote
1answer
115 views

RFC 5755 Attribute Certificate Validation

According to this explanation: Manually walking through the signature validation of a certificate I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it ...
0
votes
1answer
76 views

Cipher that does not give confirmation whether decryption is successful

I was reading this question where the author wanted to know whether layered encryption would be better than a long password. The answers to this question all said the same thing: It would be easier ...
0
votes
0answers
31 views

Know the setting used in creating key pair in GNUPG4Win version 3.15

I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation. Basically I want to use AES-128, 3DES ...
1
vote
0answers
85 views

Does using both a counter and a random nonce make sense for the purpose of reducing the likelihood of replay attacks?

I am aware that using a counter or a random value are both acceptable ways of generating nonces, depending on the circumstances. The tradeoff with using a counter is the necessity to keep state and ...
1
vote
0answers
274 views

Digital Signature is not valid

I recently received a digital signed email from a friend and the certificate is issued by COMODO RSA Client Authentication and Secure Email. My problem is the thunderbird detect it as a "Not Valid ...
9
votes
1answer
681 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
0
votes
1answer
43 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
0
votes
1answer
58 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
1
vote
1answer
98 views

What are a keypair and a public key ring?

The GNU Privacy Handbook says: The command-line option -gen-key is used to create a new primary keypair. gpg --gen-key Does a keypair mean a pair of private key and public key? The book also ...
1
vote
1answer
365 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
5
votes
1answer
153 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
0answers
46 views

IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]

I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
1answer
69 views

Can Honey Encryption be used for CAN bus security? [closed]

AES encryption was one of the best encryption techniques used but it had a major disadvantage that it cannot handle brute force attack. Hence honey encryption was introduced which can handle brute ...
1
vote
1answer
623 views

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding....
0
votes
2answers
138 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...
0
votes
1answer
122 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
1
vote
2answers
177 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
3
votes
1answer
151 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
0
votes
2answers
81 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
2
votes
1answer
128 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
-5
votes
1answer
83 views

Can someone tell me what is this encryption method? [duplicate]

DQUC//S+y9uZxanuAS0WTQBlAG4AZQBkAHwBZQByACAAegBhAGQAYQBEASAAVwBpAG4AZABvAHcAcwAC3/...
1
vote
1answer
125 views

Deniable proof of authorship

The title may read like a contradiction, but I would like to know whether a cryptographic solution exists to the following problem: Problem statement Suppose Alice wants to write a document using a ...
4
votes
1answer
121 views

How do GnuPG smartcard generate reliable random data?

I'm generating a private key on my new GPG smartcard at this very moment. On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc. How does ...
2
votes
1answer
713 views

If PGP is 2048 or 4098, then what is 128-bit encryption? [duplicate]

PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"
0
votes
0answers
100 views

X.509 Certitificate Authentication between Client / Server (REST Implementation Model)

Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ? Architecture Scenario : Lets suppose i have Client ...
3
votes
1answer
265 views

Is it possible to fake ECDSA signatures?

Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs. https://www.reddit.com/r/btc/comments/9xpivk/...
5
votes
2answers
459 views

A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean?

Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence ...